- Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193965|0 |1 is obsolete| | --- Comment #242 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194422 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194422&action=e… Bug 38365: Add CSP nonces to all inline script and style tags -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #241 from David Cook <dcook(a)prosentient.com.au> --- Ah right in the default CSP header, I don't include the report-uri or report-to... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #240 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Jonathan Druart from comment #232) > 5. We will need a commit for ktd to sync koha-conf.xml I've added that at https://gitlab.com/koha-community/koha-testing-docker/-/merge_requests/579 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #239 from David Cook <dcook(a)prosentient.com.au> --- It looks like I forgot to remove the csp_header_value from etc/koha-conf.xml and debian/templates/koha-conf-site.xml.in. I'll have to remove those... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #238 from David Cook <dcook(a)prosentient.com.au> --- Going to grab some lunch and then hook into these changes... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #237 from David Cook <dcook(a)prosentient.com.au> --- Thanks so much for looking at this, Jonathan! (In reply to Jonathan Druart from comment #232) > 1. I think we need a xt test to parse template files and catch regressions > from Jenkins. Let me know if I miss something, I can write it if you want me > to. That would be great if you could write it. Martin mentioned doing a xt test, but I didn't understand what he (or you) mean by it. I'm sure I'll understand once I see it. > 2. `use strict; use warnings;` should be replaced by `use Modern::Perl;` I can fix that up in t/Koha/Middleware/ContentSecurityPolicy.t and t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t, which I think are the only two occurrences. > 3. Is there a good reason to use Plack::Test in > t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t? IMO we should have a > Cypress test. > By the way I am expecting t/Koha/Middleware/ContentSecurityPolicy.t to fail > if there is no DB, why is it not in db_dependent? > Also I don't think those 2 includes are needed: > 27 use File::Basename qw(dirname); > 28 use HTTP::Request::Common; I'll let Lari followup with that one. > 4. Koha::Cache::Memory::Lite; is loaded in several modules but not used. Ah yep that's from an old revision. I'll remove from Koha/ContentSecurityPolicy.pm and t/Koha/ContentSecurityPolicy.t > 5. We will need a commit for ktd to sync koha-conf.xml Is the file "files/templates/koha-conf-site.xml.in" in KTD? I can do a PR for that. > 6. xt/api.t is failing > xt/api.t .. 1/8 > # Failed test 'Validation exit code is 0' > # at xt/api.t line 103. > # got: '256' > # expected: '0' > # Validation failed. /paths/public/csp-reports/post/parameters/body has > an invalid type (array,object) > # Looks like you failed 1 test of 1. Hmm that's annoying. It works in practice but swagger-cli must not like it. Perhaps we do need separate endpoints for the different report syntaxes. @Lari: can you take care of that? > xt/api.t .. 3/8 > # Failed test 'The spec passes the swagger-cli validation' > # at xt/api.t line 108. > > # Failed test 'No tag errors in the spec' > # at xt/api.t line 130. > # Structures begin differing at: > # $got->[0] = 'post /public/csp-reports -> uses tag 'csp' not > present in top level list' > # $expected->[0] = Does not exist > post /public/csp-reports -> uses tag 'csp' not present in top level list I can look into that. > 7. When enabled, I see an error in the browser's console: > Content-Security-Policy: The page’s settings blocked the loading of a > resource (media-src) at data: because it violates the following directive: > “default-src 'self'” That's interesting. I'd like to hear more about this one. Were there additional details? I wonder if it had to do with audio when doing a checkout or something? > Might be related to the other error: > Source map error: request failed with status 404 > Resource URL: > http://dev-intra.localhost/intranet-tmpl/lib/bootstrap/bootstrap.bundle. > min_25.1200026.js > Source Map URL: bootstrap.bundle.min.js.map This is a normal error. When you have the dev tools open, it'll try to fetch the non-existence bootstrap.bundle.min.js.map file. You can safely ignore that one. > > 8. It's not clear to me why we are using an env var, I would go with a > package variable. I actually faced the same problem a couple of weeks ago on > bug 41895, please have a look at Koha/Context/UserEnv.pm in the first patch > there. Originally, I was using the cache in the Plack Middleware, but the cache gets cleared by CGI::new at the start of CGI script handling. In theory a singleton using a package variable could work. I think I used an ENV variable because I knew it would be cleared with each HTTP request, but I suppose a package variable would too. Is it a blocker? Wouldn't be too hard to switch over to using a package variable. I do like the idea of using a package variable instead as it seems cleaner. > 9. Did you discuss those 3 occurrences? > misc/cronjobs/cloud-kw.pl:<style> > misc/cronjobs/overdue_notices.pl:<style type='text/css'> > misc/cronjobs/runreport.pl: > "<html><head><style>tr:nth-child(2n+1) { background-color: > #ccc;}</style></head><body>$message</body></html>"; No, we didn't talk about them. misc/cronjobs/overdue_notices.pl and misc/cronjobs/runreport.pl aren't relevant since they're sending HTML emails so CSP doesn't apply there. But misc/cronjobs/cloud-kw.pl is interesting. I think I've wanted to remove that cronjob for many years, but I think BibLibre still use it. At a glance... it looks like that HTML file is served directly from Apache rather than being generated by Plack, so it won't be covered by CSP, but it also can't really (unless a person adds the CSP header via Apache but I think that's out of scope for this change). > 10. Vue apps have styling issues: > Content-Security-Policy: The page’s settings blocked an inline style > (style-src-elem) from being applied because it violates the following > directive: “style-src 'self' 'nonce-UrNLygw_Cc1zaPU2WH0qVk'”. Consider using > a hash ('sha256-t4I2teZN5ZH+VM+XOiWlaPbsjQHe+k9d6viXPpKpNWA=', requires > 'unsafe-hashes' for style attributes) or a nonce. > It's coming from insertBySelector.js and styleTagTransform.js I have been wondering if the Vue apps would have trouble. According to https://webpack.js.org/loaders/style-loader/#nonce, style-loader isn't recommended for production. Note the security warning on https://www.npmjs.com/package/style-loader as well. How does style-loader get used in Vue currently? > 11. Not blocker but add_csp_nonces.pl should use Koha::Devel::Files to list > files. Could you elaborate on that? > 12. > (In reply to David Cook from comment #99) > > FYI bug 38407 will need to be resolved before the staff interface is ready > > for CSP in prod. > > There is no patch there, should this depends on it then? I don't think so. However, we probably should add a warning to koha-conf.xml saying not to enable CSP for intranet until after bug 38407 is resolved. Originally, I was only intending to add the CSP mechanism, and then add CSP to the OPAC, since it was ready for it. Scope creep has taken us much further. I'll still work on bug 38407 after we push this one, but I'm keen to at least get the mechanism into Koha. > 13. I didn't manage to see something in the violation logs. I enabled > dom.reporting.* in about:config, what else is needed? As Lari said, you need to have HTTPS enabled (you can do this using the snakeoil certs on the server), to use a domain name instead of local host, and make sure report-uri is set correctly because Firefox doesn't support "report-to" yet (but Chrome and Edge use "report-to" which uses a different syntax - ugh). > Side note: This will heavily conflict with bug 41324... Easy to fix, but > boring. I think it should be OK? We can toss the "Bug 38365: Add CSP nonces to all inline script and style tags" patch and re-generate to fix the merge conflict. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41978] New: REST API auth/password/validation fails on patron with a null cardnumber
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41978 Bug ID: 41978 Summary: REST API auth/password/validation fails on patron with a null cardnumber Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: ovezina(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com If you create a patron without a card number (null) and try to validate their credentials using auth/password/validation, the request will fail. Error message : Expected string - got null. The failing point isn't the validation but the return values that Koha tries to send back in Auth/Password.pm. We simply need to send: cardnumber || "", for it to work again. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 41965] New: Mismatch between SMTP server and FROM branch in multi-branch notice sending
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41965 Bug ID: 41965 Summary: Mismatch between SMTP server and FROM branch in multi-branch notice sending Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: hammat.wele(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 32726] New: Authority search result display and relator terms in 22.05
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32726 Bug ID: 32726 Summary: Authority search result display and relator terms in 22.05 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: marius.mandrescu(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 23

[Bug 15516] Allow to place a hold on first available item from a group of titles
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15516 Andrew Fuerste-Henry <andrew(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |41983 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41983 [Bug 41983] Holds to Pull and Holds Queue should show when holds are part of a group -- You are receiving this mail because: You are watching all bug changes.

1 0