- Koha-bugs - lists.koha-community.org

[Bug 36818] [CVE-2024-36057] Remote-Code-Execution (RCE) in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36818 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Remote-Code-Execution (RCE) |[CVE-2024-36057] |in upload-cover-image.pl |Remote-Code-Execution (RCE) |(CVE-2024-36057) |in upload-cover-image.pl -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 36520] [CVE-2024-36058] SQL Injection in opac-sendbasket.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36520 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection in |[CVE-2024-36058] SQL |opac-sendbasket.pl |Injection in |(CVE-2024-36058) |opac-sendbasket.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41593] New: Authenticated SQL Injection in Koha staff interface allows full database compromise
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593 Bug ID: 41593 Summary: Authenticated SQL Injection in Koha staff interface allows full database compromise Initiative type: --- Sponsorship Seeking sponsor status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: shukrulloh70(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org An authenticated SQL Injection vulnerability was identified in the Koha staff interface. A low-privileged staff user can inject arbitrary SQL queries via a vulnerable request parameter processed by the GetDistinctValues functionality. The injection occurs due to unsafe handling of user-supplied input when constructing SQL queries without sufficient sanitization or strict validation. Successful exploitation allows an authenticated attacker to fully compromise the backend database. /cgi-bin/koha/suggestion/suggestion.pl displayby vulnerebl parameter -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 21

[Bug 41636] New: Make sms_number_help text customizable
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41636 Bug ID: 41636 Summary: Make sms_number_help text customizable Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com When adding/editing a patron there is a hint next to the SMS number field: "Please enter numbers only. Prefix the number with + or 00 if including the country code." That ins't always necessarily true. This should be an HTML customization. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 41617] New: itemsearch.pl produces wrong CSV
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41617 Bug ID: 41617 Summary: itemsearch.pl produces wrong CSV Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org I've been following the CSV generation code in Koha for security reasons, and didn't notice this particular case until now. This script generates CSV using... templates instead of Text::CSV. Besides the fact this is wrong, there's a bug in the generated CSV. Bug 40880 solved an issue with the headers, but the produced file contains things like this: ``` "First field", "Second, field", "Third" ``` the extra space after the comma makes it get interpreted like: ``` First field <space>"Second <space>field" <space>"Third" ``` -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 26

[Bug 39766] New: All SIP2 config file options should be dynamically documented in the Koha manual
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39766 Bug ID: 39766 Summary: All SIP2 config file options should be dynamically documented in the Koha manual Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Documentation Assignee: koha-bugs(a)lists.koha-community.org Reporter: tristin.stagg(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: aude.charillon(a)openfifth.co.uk, philip.orr(a)lmscloud.de In troubleshooting some things, I noticed certain things like `custom_item_field` are not documented in the Wiki. I spoke with Kyle H. and it was suggested we include this information in the Koha manual instead. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 42308] New: Add filtering and sort to authority search in advanced editor
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42308 Bug ID: 42308 Summary: Add filtering and sort to authority search in advanced editor Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Being able to sort and filter results after preforming a search from the advanced editor. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 18485] New: REST API: add endpoint for calendar
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18485 Bug ID: 18485 Summary: REST API: add endpoint for calendar Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Web services Assignee: koha-bugs(a)lists.koha-community.org Reporter: black23(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Hello, new calendar (bug 17015) works with opening hours, so new endpoint for calendar will be useful for transfer informations about opening hours into other systems. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 6

[Bug 39486] New: We should expose open/closed days via the REST API
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39486 Bug ID: 39486 Summary: We should expose open/closed days via the REST API Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com We could do with a way of fetching calendar closed/open days via the API -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 39439] New: Show branch specific link to cancellation requests on home page
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39439 Bug ID: 39439 Summary: Show branch specific link to cancellation requests on home page Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Bug 36064 added a link to the homepage that shows pending cancellation requests. Large systems may load very slowly. Adding a branch specific link, similar to the purchase suggestions would help alleviate this. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2