- Koha-bugs - lists.koha-community.org

[Bug 42361] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 --- Comment #26 from Lucas Gass (lukeg) <lucas(a)bywatersolutions.com> --- Filed a new report for the regression: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42803 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42361] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 Lucas Gass (lukeg) <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42803 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42803 [Bug 42803] Regression in reports/catalogue_out.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42361] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 Luis Bataller <luis.bataller(a)xercode.es> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |luis.bataller(a)xercode.es --- Comment #11 from Luis Bataller <luis.bataller(a)xercode.es> --- We've actually been carrying a local patch for this at Xercode for over a year now, and it's basically David's comment #8 (option 2): an optional plugin hook that lets the plugin say which permissions a given method needs. The gist of it: - run.pl keeps its current default of { plugins => $method }. - If the plugin implements the hook, run.pl calls it (passing the method and the relevant CGI params) and uses whatever it returns as flagsrequired for get_template_and_user. - The hook returns a normal flagsrequired, or undef to fall back to the default. So nothing changes for plugins that don't implement it. On David's worry in comment #10 (plugins just letting anyone do anything): the hook doesn't return allow/deny. It returns a flagsrequired that Koha still checks itself via haspermission()/get_template_and_user. So a plugin can only pick which existing Koha permission guards a method — it can't bypass the check or drop it below "you need some real Koha permission". Enforcement stays in core. It's also a small, low-coupling change: the only file touched is run.pl, and it's fully backwards-compatible — plugins that don't implement the hook behave exactly as before. A year in production has made us pretty confident in it, and we're glad to tidy it up to community standards. One naming thought: David called it koha_authz in comment #8. We'd actually lean towards permissions_required here, since the hook doesn't grant or do any authorization itself. Happy to go with whatever you all prefer, though. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 27570] New: Allow the ability to alter what a Lost Charge displays for the Patron
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27570 Bug ID: 27570 Summary: Allow the ability to alter what a Lost Charge displays for the Patron Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: kelly(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com A library would like the ability to alter the Lost terminology for their patron's accounting when they are marking something Lost. They had a value of damage to the Lost Status and would like to see Koha bill a patron for a "damaged" book. Currently, Koha will always use the word "Lost" in the Accounting/Fine portion of the patron's record- regardless of what Lost status the library is marking the item as. This could introduce a lot more flexibility when working with libraries and their billing procedures. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 35229] New: Add further cypress tests for Usage reporting
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35229 Bug ID: 35229 Summary: Add further cypress tests for Usage reporting Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ERM Assignee: jonathan.druart+koha(a)gmail.com Reporter: matt.blenkinsop(a)ptfs-europe.com CC: jonathan.druart+koha(a)gmail.com, jonathan.field(a)ptfs-europe.com, martin.renvoize(a)ptfs-europe.com, matt.blenkinsop(a)ptfs-europe.com, pedro.amorim(a)ptfs-europe.com -- You are receiving this mail because: You are watching all bug changes.

1 20

[Bug 36694] New: Remove HC Sticky library in favor of CSS
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36694 Bug ID: 36694 Summary: Remove HC Sticky library in favor of CSS Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CSS sticky is now widely available across major browsers. I think we can use it instead of the HC sticky library now. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 167

[Bug 32709] New: Background job UI and REST API routes explode if JSON is incorrect
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32709 Bug ID: 32709 Summary: Background job UI and REST API routes explode if JSON is incorrect Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: major Priority: P5 - low Component: Staff interface Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Same as bug 32393, but for the REST API routes and the UI. -- You are receiving this mail because: You are watching all bug changes.

1 7

[Bug 26333] New: "In" analytics link incorrectly formed when "UseControlNumber" set to "Don't use"
by bugzilla-daemon＠bugs.koha-community.org 09 Jun '26

09 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26333 Bug ID: 26333 Summary: "In" analytics link incorrectly formed when "UseControlNumber" set to "Don't use" Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com The "In" links for analytics don't work if not using control numbers To test: - Pick any serial record in your database, make sure 001 is set - Go to new > new child record - Fill in 245 and save - Click on the "In" link, it will not find the record - Look at the link, it is performing a title,phrase search but populating the link with both the author and title -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 42794] New: If duplicate barcode detected when adding an item, put a link to that item next to the error message.
by bugzilla-daemon＠bugs.koha-community.org 08 Jun '26

08 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42794 Bug ID: 42794 Summary: If duplicate barcode detected when adding an item, put a link to that item next to the error message. Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: crosenthal(a)pwcgov.org QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Currently in additem.pl, if an item is added with barcode that already exists in Koha, the message "Error saving item: Barcode must be unique." appears It would be handy to have the item that already has that barcode listed or at least linked next to the error message -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0