- Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #437 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #436) > Anyway, food for thought. I've raised "Bug 42725 - Show effective Content-Security-Policy in about.pl UI?" just so that this idea doesn't get lost in comment messages. This isn't an enhancement that would help me or my libraries per se, but I'm trying to help the rest of the world, and this is just one way I think we could do that. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42725 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42725 [Bug 42725] Show effective Content-Security-Policy in about.pl UI? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42725] New: Show effective Content-Security-Policy in about.pl UI?
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42725 Bug ID: 42725 Summary: Show effective Content-Security-Policy in about.pl UI? Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Web users of the staff interface cannot change the Content-Security-Policy setting, but it could be useful for them to see its content in an easily accessible way in about.pl This way, we could encourage library staff to review their about.pl System Information and then contact their technical team for updates if necessary. I'm just trying to think of ways of building awareness about security topics, which will help out Koha libraries in practical ways. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #436 from David Cook <dcook(a)prosentient.com.au> --- Posting here just to gather feedback from interested parties... What do people think about showing the effective Content-Security-Policy on the about.pl page? It's trivial for a tech savvy person to see the policy. They just need to review the headers sent back from the server. If we show the policy to a non-technical audience, they'd at least be able to speak to the current state of affairs *to* their technical teams. I mention this because it would be nice to be able to refer people to the Content-Security-Policy in https://wiki.koha-community.org/wiki/Security_Hardening_Guide While I can say "oh hey look at the headers or look at koha-conf.xml", it's probably going to be more meaningful to see the config in about.pl Anyway, food for thought. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 39222] New: Error 403 when login OPAC and Intranet
by bugzilla-daemon＠bugs.koha-community.org 30 May '26

30 May '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39222 Bug ID: 39222 Summary: Error 403 when login OPAC and Intranet Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: costalc(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Description (in spanish) Lo sentimos, la página solicitada no se encuentra disponible Error 403 Este mensaje puede tener la(s) razón(es) siguiente(s): Tiene prohibido ver esta página. ¿Qué será lo próximo? Puede utilizar el menú y enlaces en el tope de la página Puede buscar en el catálogo usando el formulario de búsqueda en la parte superior de esta página. Regresar a la página principal del catálogo. Informar problemas y enlaces rotos Para informar sobre este error, por favor, póngase en contacto con el Administrador de Koha. Enviar correo electrónico. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 11

[Bug 42724] New: Deleting a hold immediately after checking out to a patron fails
by bugzilla-daemon＠bugs.koha-community.org 30 May '26

30 May '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42724 Bug ID: 42724 Summary: Deleting a hold immediately after checking out to a patron fails Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: ephetteplace(a)cca.edu QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com Steps to recreate: 1. Create a hold for a patron (e.g. search for a bib > place hold > look up patron) 2. Go to Circulation > Check out 3. Look up the same patron 4. Check out a different item to them using its barcode 5. Switch to the Holds tab and click the delete icon for the hold from step #1 6. Confirm cancellation (reason doesn't matter) Expected: hold deletes. You remain on the patron's circ page. Actual: you are taken back to Circulation > Check out with no patron selected ("/circ/circulation.pl?borrowernumber=" note the lack of borrowernumber). The hold is not deleted; if you look up the patron again, it's still there. This happens specifically after checking out an item first and not otherwise. If you go to Circulation > Check Out and delete the hold first, it succeeds. First noticed as part of testing for Bug 42116 but I do not believe it's related. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 37679] New: DC export option broken by bug 37370
by bugzilla-daemon＠bugs.koha-community.org 30 May '26

30 May '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37679 Bug ID: 37679 Summary: DC export option broken by bug 37370 Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Bug 37370 added a check on valid formats defined on the `OpacExportOptions` syspref, but it turns out the `opac-export.pl` script receives another strings (subtypes) when one of the DublinCore options is selected. This was not considered on the bug and needs to be fixed. -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 39485] New: opac-export: Wide character in print at opac-export.pl line 191
by bugzilla-daemon＠bugs.koha-community.org 30 May '26

30 May '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39485 Bug ID: 39485 Summary: opac-export: Wide character in print at opac-export.pl line 191 Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org >From a 23.11 log (lineno different) [2025/03/16 21:11:18] [WARN] Wide character in print at /usr/share/koha/opac/opac-export.pl line 189. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 16

[Bug 31698] New: Add ability to move a hold to a new biblio/item
by bugzilla-daemon＠bugs.koha-community.org 29 May '26

29 May '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31698 Bug ID: 31698 Summary: Add ability to move a hold to a new biblio/item Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Sometimes a library gets a new edition, or a new copy of an item and would like to be able to directly provide this to a patron with an existing hold. We propose add a new action on the holds table on request.pl 'Move hold' For an item level hold it would provide a modal with a barcode entry box so librarians can scan a new copy in hand, and move the hold to that specific item For a biblio level hold it would provide a modal with a search box - entering keywords would search the catalog, and add a 'Move hold' button to the results - similar to 'Add to basket form existing record' search in acquisitions -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 198

[Bug 42600] New: timeout system preference - update to manual to match description
by bugzilla-daemon＠bugs.koha-community.org 29 May '26

29 May '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42600 Bug ID: 42600 Summary: timeout system preference - update to manual to match description Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Documentation Assignee: koha-bugs(a)lists.koha-community.org Reporter: david(a)davidnind.com QA Contact: testopia(a)bugs.koha-community.org CC: aude.charillon(a)openfifth.co.uk, david(a)davidnind.com, philip.orr(a)lmscloud.de The current information in the manual for the timeout system preference is not correct and doesn't match what is in Koha: - Can now add 'd' to specify value in days - The text doesn't match - Clarify that this setting applies to both the OPAC and staff interface Current description in the manual: Automatically log out users after ___ seconds of inactivity. Current description in Koha: Inactivity timeout in seconds to automatically log out users: [1d] Adding d will specify it in days, e.g. 1d is timeout of one day. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 9