- Koha-bugs - lists.koha-community.org

[Bug 42060] Error 500 when attempting to pay overdue fines for returned items, with phantom credits accumulating on patron accounts
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42060 amanda(a)koalan.com.br <amanda(a)koalan.com.br> changed: What |Removed |Added ---------------------------------------------------------------------------- Group|Koha security | Product|Koha security |Koha Version|unspecified |25.05 Component|Koha |Fines and fees QA Contact| |testopia(a)bugs.koha-communit | |y.org Assignee|chris(a)bigballofwax.co.nz |koha-bugs(a)lists.koha-commun | |ity.org --- Comment #2 from amanda(a)koalan.com.br <amanda(a)koalan.com.br> --- Yes. Its 25.05.05. And I agree with you, its koha not security -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42065] New: Add errors/404.pl to Apache bot challenge
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42065 Bug ID: 42065 Summary: Add errors/404.pl to Apache bot challenge Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org Bots have been known to spam an error page just to overload the site. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #359 from David Cook <dcook(a)prosentient.com.au> --- I'm considering this Signed Off now. Jonathan, how are you feeling in terms of QA? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #358 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 195107 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195107&action=e… Bug 38365: Add context to Koha::Devel::Files in add_csp_nonces.pl The add_csp_nonces.pl file should use the exceptions in Koha::Devel::Files. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #357 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #356) > Once bug 38365 is pushed, we can require that people add nonces to <script> > and <style> inline elements (the QA tools will alert to this). > > And then I'll continue the work on bug 38407. Since the value builders are > handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33 > files, which isn't too bad at all. (But I agree is out of scope for bug > 38365, which is big enough already.) Actually maybe some plugins do still have some inline event handlers. I'll deal with this too though. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #356 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Lari Taskula from comment #325) > (In reply to David Cook from comment #315) > > Created attachment 194607 [details] [review] [review] > > Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t > > > > This initialises the CSP nonce in the unit test so that > > t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt > > will get its script element rewritten correctly. > > Do we still need this patch after excluding test_valuebuilder_popup.tt in > Koha::Devel::Files and xt/find-missing-nonce.t? Yes. It's used by t/lib/plugins/Koha/Plugin/TestValuebuilder.pm > Is there a way to make Valuebuilder_hooks.t test fail in the first place? I > tried rebasing before and after this commit but it always passed, so I don't > understand the purpose of this change and the patch. Yes, if you comment out these lines: use Koha::ContentSecurityPolicy; my $csp = Koha::ContentSecurityPolicy->new; $csp->set_nonce(); Then it will fail. There must've been an issue with your rebase I'm guessing. > `add_csp_nonces.pl --apply` still modifies test_valuebuilder_popup.tt. > Should we call its Koha::Devel::Files constructor with context => 'nonce' so > that test_valuebuilder_popup.tt will not be modified by the script? Good catch. I'll fix that. > (In reply to David Cook from comment #316) > > Created attachment 194608 [details] [review] [review] > > Bug 38365: Make tidy.pl compatible with script elements with attributes > > > > tidy.pl will still tidy whitespace around script elements that have > > attributes like "nonce" > > OK. `perl misc/devel/tidy.pl --tt` changes > t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt (file introduced > in this bug). > > (In reply to David Cook from comment #317) > > Created attachment 194609 [details] [review] [review] > > Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome > > imports > This is out of my expertise, how to test? My bad. I thought that I wrote a test plan for it. You need to rebuild the resources, turn on ERM, and visit the ERM home. Steps: 1. perl build-resources.PL (this is part of the "important" test plan) 2. Enable syspref ERMModule 3. Go to http://localhost:8081/cgi-bin/koha/erm/home 4. Note that no CSP violations appear in the console > Not to take anything away from the good work and important findings on the > staff client side as seen in that patch, but we should redefine the scope of > this Bug. It is clear from the title of this Bug [1] that the scope has been > expanding. It has also been established that CSP is not ready to be enabled > in the staff client and my understanding is that a lot of work remains to be > done there. But as far as we know OPAC is quite close. So my question is how > much do we want to (and can) work on the staff client side of things in this > Bug? > > We have a library that is willing to enable this on the OPAC side. In fact > they are already running an older implementation but we would like to see it > replaced with this one. Having this tested in the real world would be good > even if it was initially just OPAC. > > I also fear that we might run out of steam if this Bug's scope expands too > much into the staff client as well. > > [1] (at the time of this comment the title is "Add Content-Security-Policy > HTTP header to HTML responses") Yeah, I think this is as far as we go for bug 38365. We sign this off, QA it, and push it as is. -- Once bug 38365 is pushed, we can require that people add nonces to <script> and <style> inline elements (the QA tools will alert to this). And then I'll continue the work on bug 38407. Since the value builders are handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33 files, which isn't too bad at all. (But I agree is out of scope for bug 38365, which is big enough already.) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 39906] Add bot challenge (in Apache layer)
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39906 Aleisha Amohia <aleisha(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42065 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42065 [Bug 42065] Add errors/404.pl to Apache bot challenge -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34594] New: Incorrect table name in OpacHiddenItems causes searches to fail or details not to display
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34594 Bug ID: 34594 Summary: Incorrect table name in OpacHiddenItems causes searches to fail or details not to display Change sponsored?: --- Product: Koha Version: 22.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: wizzyrea(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Example case: Library put damage: [1,2] and searches failed with the following error: [2023/08/22 14:19:05] [WARN] No method count found for Koha::Items DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'me.damage' in 'where clause' at /usr/share/koha/lib/Koha/Objects.pm line 578 It would be so nice to fix this so that invalid configurations are ignored, or the preference could check upon save to verify the values input are valid. -- You are receiving this mail because: You are watching all bug changes.

1 6