- Koha-bugs - lists.koha-community.org

[Bug 41662] CSRF-vulnerability in opac-patron-consent.pl.
by bugzilla-daemon＠bugs.koha-community.org 02 Feb '26

02 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41662 --- Comment #15 from Andreas Jonsson <andreas.jonsson(a)kreablo.se> --- Sorry for not paying attention to this issue, but only look att the op parameter as this requires that this validation is made in checkauth: # FIXME This is only needed for scripts not using plack my $op = $query->param('op'); if ( defined $op && $op =~ m{^cud-} ) { die "Cannot use GET for this request" if $request_method eq 'GET'; } The comment suggest that this check may be removed at some point. Wouldn't it be safer to validate the method directly? - if ( $op && $op eq 'cud-save' ) { + if ( uc $query->request_method eq 'POST' ) { -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41748] New: ILLRequestsTabs: On loan-status won't sort under that tab
by bugzilla-daemon＠bugs.koha-community.org 02 Feb '26

02 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41748 Bug ID: 41748 Summary: ILLRequestsTabs: On loan-status won't sort under that tab Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: piia.semenoff(a)ouka.fi QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com, pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Created attachment 192285 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192285&action=e… ILLRequestsTabs Example of On loan-tab On loan -status won't sort under that tab in ILLRequestsTabs. If I make tab by Koha's example, the sorting won't work and under On loan-tab are detailss of all ILL-requests. There should be only details of ILL-requests that are on loan. Koha's example: - name: On loan status: - CHK -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 30968] New: opac-authorites-home.pl still accessible even when OpacAuthorities system preference is turned off
by bugzilla-daemon＠bugs.koha-community.org 02 Feb '26

02 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30968 Bug ID: 30968 Summary: opac-authorites-home.pl still accessible even when OpacAuthorities system preference is turned off Change sponsored?: --- Product: Koha Version: 21.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: wizzyrea(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org When the system preference OpacAuthorities is turned off, the page https://your.library.here/cgi-bin/koha/opac-authorities-home.pl is still accessible and likely shouldn't be. To test: set OpacAuthorities to Don't Allow try to visit https://your.library.here/cgi-bin/koha/opac-authorities-home.pl note that the page is still accessible. Thanks for checking it out! Liz -- You are receiving this mail because: You are watching all bug changes.

1 3

[Bug 41743] New: AWS Subsription Install Does Not Setup Correctly
by bugzilla-daemon＠bugs.koha-community.org 02 Feb '26

02 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41743 Bug ID: 41743 Summary: AWS Subsription Install Does Not Setup Correctly Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.11 Hardware: Other OS: Linux Status: NEW Severity: major Priority: P5 - low Component: Installation and upgrade (web-based installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: baceman007(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Hello, I subscribed to and used the CloudFormation install option on AWS to install Koha. I made sure my database is connected to my EC2 instance and that all relevant ports are open including 3306. When I try to enter a new record in the catalog, or import a record using the SRU option on the same page I receive the error. "Could not compile /usr/share/koha/intranet/cgi-bin/cataloguing/addbiblio.pl: "prepare_host_field" is not exported by the C4::Biblio module Can't continue after import errors at /usr/share/koha/intranet/cgi-bin/cataloguing/addbiblio.pl line 29. BEGIN failed--compilation aborted at /usr/share/koha/intranet/cgi-bin/cataloguing/addbiblio.pl line 41. at /usr/local/share/perl/5.34.0/CGI/Compile.pm line 144" I tried commenting out the "prepare_host_field" parameter in addbiblio.pl but this setup does not allow me to do so as I do not have permission to modify the file via the AWS setup. Has anyone else run into this issue? How did you solve it? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 41723] New: Library groups needs feature to limit switching libraries within the group
by bugzilla-daemon＠bugs.koha-community.org 02 Feb '26

02 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41723 Bug ID: 41723 Summary: Library groups needs feature to limit switching libraries within the group Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com We've wanted staff to be limited to switching libraries to specific libraries in their group. It makes sense to put a feature in library groups that could limit what libraries they can switch between, if allowed to switch. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 39669] New: Update reserves notices to use Koha::Patron->queue_notice
by bugzilla-daemon＠bugs.koha-community.org 30 Jan '26

30 Jan '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39669 Bug ID: 39669 Summary: Update reserves notices to use Koha::Patron->queue_notice Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org Blocks: 37214 This is one of the more challenging cases as C4::Reservers supports Digests and thus uses C4::Message. It would be a good one to build out tests for and enhance the Koha::Patron->enqueue_notice message, allowing for more adoption of messaging preferences and digest functionality. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37214 [Bug 37214] We should migrate to Koha::Patron->queue_notice wherever possible -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 39176] New: Update additional_field_values.record_id to varchar(255)
by bugzilla-daemon＠bugs.koha-community.org 30 Jan '26

30 Jan '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39176 Bug ID: 39176 Summary: Update additional_field_values.record_id to varchar(255) Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org In bug 38663 we had to switch from int(11) to varchar(11) so we could properly store branchcode, the primary key for the branches table. In bug 38457 I'm now faced with the same issue of needing to update the field from varchar(11) to varchar(80) to allow for the code field in the account_debit_types table which is a varchar(80) primary key. Looking to the future and how we're starting to add more and more uses of additional fields I think we should pick the largest current primary key field and match that. SELECT t.TABLE_NAME AS table_name, k.COLUMN_NAME AS primary_key_field, CASE WHEN k.CHARACTER_MAXIMUM_LENGTH IS NOT NULL THEN CONCAT(k.DATA_TYPE, '(', k.CHARACTER_MAXIMUM_LENGTH, ')') WHEN k.NUMERIC_PRECISION IS NOT NULL THEN CONCAT(k.DATA_TYPE, '(', k.NUMERIC_PRECISION, ')') ELSE k.DATA_TYPE END AS primary_key_type FROM INFORMATION_SCHEMA.TABLES t JOIN INFORMATION_SCHEMA.COLUMNS k ON t.TABLE_NAME = k.TABLE_NAME AND t.TABLE_SCHEMA = k.TABLE_SCHEMA JOIN INFORMATION_SCHEMA.KEY_COLUMN_USAGE ku ON t.TABLE_NAME = ku.TABLE_NAME AND t.TABLE_SCHEMA = ku.TABLE_SCHEMA AND k.COLUMN_NAME = ku.COLUMN_NAME JOIN INFORMATION_SCHEMA.TABLE_CONSTRAINTS tc ON ku.TABLE_NAME = tc.TABLE_NAME AND ku.TABLE_SCHEMA = tc.TABLE_SCHEMA AND ku.CONSTRAINT_NAME = tc.CONSTRAINT_NAME WHERE t.TABLE_SCHEMA = DATABASE() AND tc.CONSTRAINT_TYPE = 'PRIMARY KEY' ORDER BY t.TABLE_NAME; Using the above query, I believe that shows the largest is a varchar(255). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 9181] Add patron messaging preferences to batch patron modification tool
by bugzilla-daemon＠bugs.koha-community.org 30 Jan '26

30 Jan '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9181 Marie Martino <martinom43(a)morainevalley.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martinom43(a)morainevalley.ed | |u --- Comment #13 from Marie Martino <martinom43(a)morainevalley.edu> --- My community college library is also super-interested in this enhancement. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 24288] New: Add wording to authorized value interface to indicate valid code length
by bugzilla-daemon＠bugs.koha-community.org 30 Jan '26

30 Jan '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24288 Bug ID: 24288 Summary: Add wording to authorized value interface to indicate valid code length Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Several standard authorized values feed into fields that require a single character code (LOST, NOTFORLOAN, DAMAGED, RESTRICTED, WITHDRAWN). It'd be good to have some wording in the authorized value interface that would indicate this. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 29

[Bug 23861] New: Add authorised value categories description option
by bugzilla-daemon＠bugs.koha-community.org 30 Jan '26

30 Jan '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23861 Bug ID: 23861 Summary: Add authorised value categories description option Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com I really like the way the authorised values page looks now. I think it's much more user friendly with the descriptions and the categories all laid out and not in a drop-down. Right now, the descriptions for each category are "hardcoded" in the template. Would it be feasible to move those in the DB? That way, when we add new categories, we would be able to add our own description. For example, if I add a category for RDA media type, I would be able to add a description saying it's meant to be used with 337$a. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14