- Koha-bugs - lists.koha-community.org

[Bug 43426] admin/item_circulation_alerts.pl cud-toggle performs no authentication check at all (7.5 HIGH)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43426 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pedro.amorim(a)openfifth.co.u | |k Resolution|--- |FIXED Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 Status|Pushed to stable |RESOLVED Keywords|RM_priority | --- Comment #25 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43424] REST Basic Auth bypasses account lockout (8.1 HIGH)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43424 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Keywords|RM_priority | Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 Status|Pushed to stable |RESOLVED CC| |pedro.amorim(a)openfifth.co.u | |k --- Comment #21 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43326] Stored XSS in patron account note (accountlines.note)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43326 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|RM_priority | Status|Pushed to stable |RESOLVED Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 CC| |pedro.amorim(a)openfifth.co.u | |k Resolution|--- |FIXED --- Comment #15 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42674] OS command injection via `jobid` in Task Scheduler (`tools/scheduler.pl`)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|RM_priority | Resolution|--- |FIXED CC| |pedro.amorim(a)openfifth.co.u | |k Status|Pushed to stable |RESOLVED Version(s)|26.05.04,25.05.15,24.11.20, |26.11.00,26.05.04,25.05.15, released in|25.11.09 |24.11.20,25.11.09 --- Comment #17 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37441] New: Sometimes images don't upload in Uploads Tool
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37441 Bug ID: 37441 Summary: Sometimes images don't upload in Uploads Tool Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: alexandre.noel(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org The file upload tool intermittently fails, causing the selected file to disappear without uploading. The second time we want to upload, it will work. Replicate: 1. Go to Tools > Uploads 2. Click "Choose file" and select any file (png, jpeg, pdf...) 3. Click "Upload" -> The file uploads successfully 4. Click "Delete" to remove the uploaded file. -> The page returns to the upload screen. Repeat steps 2 and 3. -> The selected file is deleted, and is not uploaded, requiring the process to be restarted. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14

[Bug 42295] New: Tidy all script tags - includes staff
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42295 Bug ID: 42295 Summary: Tidy all script tags - includes staff Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Blocks: 42094 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42094 [Bug 42094] Tidy all script tags (except value_builder) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 91

[Bug 40294] New: Mandatory patron expiration notice is not sent if patron does not have a primary contact method defined
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40294 Bug ID: 40294 Summary: Mandatory patron expiration notice is not sent if patron does not have a primary contact method defined Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: emily.lamancusa(a)montgomerycountymd.gov QA Contact: testopia(a)bugs.koha-community.org Depends on: 30301 Bug 30301 added the option to force mandatory account expiration notices for a given patron category in the membership_expiry cron. In these cases, the primary contact method on the patron account is used to determine the transport type for the notice. However, primary contact method may not be a mandatory field depending on the system preference settings. If a patron doesn't have a primary contact method set for their account, this causes the notice not to get sent at all, even if the patron has one or more valid email addresses or SMS number on their account. We need a fallback to ensure the mandatory notice is sent in this case. I think it would make the most sense to specify transport type(s) in the patron category settings when making account expiration notices mandatory for that category. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30301 [Bug 30301] Add an option to specify the patron expiration notices as mandatory by patron category -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 117

[Bug 41604] New: Impossible to hide Checkin column in issues-table in circ/circulation.pl
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41604 Bug ID: 41604 Summary: Impossible to hide Checkin column in issues-table in circ/circulation.pl Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Bug 41314 caused a regression, making it impossible to hide the Checkin column in the issues table in the patron's circulation page. We had complaints about this following our first wave of upgrades from 24.05(.05) to 25.05(.06). To recreate: 1. Hide the checkin column by default in circulation issues-table 1.1. Go to Administration > Table settings > Circulation tab > Jump to page : circulation > Table id: issues-table 1.2. Check "Is hidden by default" for "checkin" 1.3. Click "Save" 2. Checkout an item to a patron 2.1. In the search bar, set to Checkout, search for Henry 2.2. In the checkout field, enter the barcode 39999000010114 and press enter --> In the table of issues, Checkin column is visible, it should be hidden by default I personally find the checkin column particularly dangerous as staff don't need to scan the item to return it, leading to potentially checking in items that weren't actually returned by the patron. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 193

[Bug 30221] New: Make the tables on opac-user.tt column configurable
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30221 Bug ID: 30221 Summary: Make the tables on opac-user.tt column configurable Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org There are several tables on opac-user.tt that would benefit from being column configurable. ( check-outs, overdues, charges, holds, article requests ) -- You are receiving this mail because: You are watching all bug changes.

1 100

[Bug 23861] New: Add authorised value categories description option
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23861 Bug ID: 23861 Summary: Add authorised value categories description option Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com I really like the way the authorised values page looks now. I think it's much more user friendly with the descriptions and the categories all laid out and not in a drop-down. Right now, the descriptions for each category are "hardcoded" in the template. Would it be feasible to move those in the DB? That way, when we add new categories, we would be able to add our own description. For example, if I add a category for RDA media type, I would be able to add a description saying it's meant to be used with 337$a. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 15