- Koha-bugs - lists.koha-community.org

[Bug 4042] Public OPAC search can fall prey to web crawlers
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4042 Barry Cannon <bc(a)interleaf.ie> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bc(a)interleaf.ie --- Comment #12 from Barry Cannon <bc(a)interleaf.ie> --- Reading over this bug it occurs to me that some of the steps we have taken to mitigate this problem might help others. I will post high level information here, in case it might help some people along. The first step we took (after adding robots.txt) was to add a small piece of code to the OPACHeader syspref that appended a “hidden” a href tag to a script (sneakysnare.pl) on the site. This would be only visible to bots and once this link was followed a page would show with a lot of useless text. In the background though the script grabbed the source IP address and pushed it into a deny rule on the firewall. This worked well for bots that blindly followed all links from the page. Shortly after we noticed that not all bots were following all links. Our next step was to check the useragent of the incoming traffic. We noticed that there were a lot of useragent strings causing issues. Configuring apache for a CustomLog of “time,IP,METHOD,URI” we configured a script to run regularly to parse this file for know “bad” useragent strings. We were then able to add these IPs to the firewall to be dropped. Our current setup is expanded from above: all our servers use csf/lfd for local firewall and intrusion detection. We also use ipset extensively for other non-Koha related services. Csf can be configured to offload deny chains to ipset. This helps iptables and lowers the resource strain on the server. Csf can be configured to use an Include file to deny hosts. By expanding on the sneakysnare script and the useragent apache log we create a small job to bring all this together and manage an csf include file. The job checks this new file and if a new IP address has appeared it will add that IP to the deny set. In some cases we have observed the server being slowly scrapped. This insidious scrapping is harder to detect immediately and often slows/hogs resources over a longer period. Quite often the source of these connections are from a particular geographical region. If this happens - often enough - we can employ geoblocking. Csf can be configured to use Maxmind GeoIP database lookup. Using the configuration file we specify the country code we want to block. For example to block all Irish and British traffic (not that we would!) we enter the “IE,GB” into the config file. Once the daemon is restarted the GeoIP database is referenced and all known CIDR blocks for those nountries are loaded into ipset’s deny set. Csf can also be configured to “deny all, except”. It this setup placing “IE” in the config file would only allow traffic from Ireland and deny all other traffic. There are pros and cons to all of the above and consideration should be given before implementation. Third party services are also very useful and moving traffic via CDN providers (and using their security services) will greatly reduce bots, DDOS and other hassle. Other helpful methods include reverse proxies and mitigating at that level. -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

1 0

[Bug 11299] Add a button to automatically link authority records in cataloguing (AJAX)
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11299 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #106 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Regarding history I am removing the FQA status, letting QA step for someone else. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11299] Add a button to automatically link authority records in cataloguing (AJAX)
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11299 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #105 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- 1. I see a new sub added to C4 without test coverage. Moreover it's c/ping a lot of code from LinkBibHeadingsToAuthorities (refactoring needed) 2. New images must be replaced by bootstrap icons 3. In authorities.pl, "require C4::Heading;" why require instead of use? 4. addbiblio needs permission editcatalogue and displays the "linker button", but cataloguing/automatic_linker.pl requires editauthorities. I think the button must be hidden if permission is not sufficient. 5. Hazardous indentation in some file, for instance: +function confirmnotdup(redirect){ + $("#confirm_not_duplicate").attr("value","1"); + $("#redirect").attr("value",redirect); + Check(); +} -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7611] Show the NOT_LOAN authorised values for item status in XSLT OPAC search results
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7611 --- Comment #43 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 97808 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97808&action=ed… Bug 7611: (follow-up) separate positive and negative statuses as in the past This patch preserves someting closer to previous functionality. Negative not for loan are in the 'unavailable' section in red, positive ones are in the 'reference' section in green. Itemtype level will also be in green in reference Item specific status will override an itemtype level. The line break between 'reference' and 'unavailable' existed before and is preserved - negative not for loan and checked out items appear here -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7611] Show the NOT_LOAN authorised values for item status in XSLT OPAC search results
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7611 --- Comment #42 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 97807 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97807&action=ed… Bug 7611: (follow-up) Fix display of undefined statuses and add a class -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7611] Show the NOT_LOAN authorised values for item status in XSLT OPAC search results
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7611 --- Comment #41 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 97806 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97806&action=ed… Bug 7611: (follow-up) Add missing space -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7611] Show the NOT_LOAN authorised values for item status in XSLT OPAC search results
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7611 --- Comment #40 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 97805 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97805&action=ed… Bug 7611: Change negative notforloan as well This makes the changes apply to both positive and negative notforloan values The extra line generated before is removed Some spans are added and cleaned up and labels moved to CSS to allow for easier altering where needed Itemtypes marked notforloan remain as reference, the label can be changed via css To test: 1 - Have a record with items in various statuses, ideally - 3 available, with 2 in one branch, 1 in another - 3 with itemtype not for loan, 2 in one branch, 1 in another - 3 in a positive not for loan status, 2 and 1 as above - 3 in a negative not for loan status, 2 and 1 as above - 1 in a different positive loan status, but with the same opac description as the negative above 2 - Search the opac to include this record, take a screenshot 3 - Apply patch 4 - Restart all and refresh 5 - Compare to screen shot 6 - Differences include: - Positive statuses are now on separate line with opac description showing - Unavailable (not for loan items) now include callnumber and branch in display - Positive and negative notforloan with same description are combined where branches match - Inspect the elements, note new spans around 'Items available for loan/reference' 7 - Add to OPACUserCSS: .ItemSummary .ItemBranch{ display:none; } .unavailable .ItemSummary .CallNumber,.unavailable .ItemSummary .LabelCallNumber{ display:none; } 8 - Note the branches are hidden, and callnumbe rhidden for unavailable items Signed-off-by: Jessica Zairo <jzairo(a)bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7611] Show the NOT_LOAN authorised values for item status in XSLT OPAC search results
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7611 Nick Clemens <nick(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #95236|0 |1 is obsolete| | Attachment #95237|0 |1 is obsolete| | Attachment #95238|0 |1 is obsolete| | Attachment #95239|0 |1 is obsolete| | Attachment #95240|0 |1 is obsolete| | --- Comment #39 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 97804 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97804&action=ed… Bug 7611: Show the NOT_LOAN authorised values for item status in XSLT OPAC search results Added : Call number for all not for loan status XSLT Results template improvement : Use the NOT_LOAN authorised values Improvement : Use the NOT_LOAN authorised values when showing items status in the OPAC search results. Before this patch, these items were only considered as "unavailable". Note : This patch only affects the OPAC XSLT search results template for MARC21 records. This patch was not tested on UNIMARC or NORMARC records. I won't be able to support these formats, so I'm hoping someone could do the same for these other record formats. Patch sponsored by the CCSR ( http://www.ccsr.qc.ca ) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7611] Show the NOT_LOAN authorised values for item status in XSLT OPAC search results
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7611 Nick Clemens <nick(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13121] Move search results "action" links ("Place hold, " "Add tag, " etc) into include file
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '20

23 Jan '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13121 David Nind <david(a)davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david(a)davidnind.com --- Comment #4 from David Nind <david(a)davidnind.com> --- I'm assuming 'Shelf contents view' is either the Cart or Lists - all the actions seem to work as expected in those areas. -- You are receiving this mail because: You are watching all bug changes.

1 0