- Koha-bugs - lists.koha-community.org

[Bug 42719] New: OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists (IdP-initiated flow)
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42719 Bug ID: 42719 Summary: OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists (IdP-initiated flow) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: martin.renvoize(a)openfifth.co.uk CC: dpavlin(a)rot13.org When a user initiates login from the IdP (e.g. clicking an app tile in Okta), they are redirected directly to Koha's /api/v1/oauth/login/{provider}/{interface} endpoint without ever visiting a Koha page first. Since no Koha page was visited, no session exists and no CGISESSID cookie is present. The code at Koha::REST::V1::OAuth::Client line 99 calls: $c->req->cookie('CGISESSID')->value This crashes with: Can't call method "value" on an undefined value The fix is to create a session on-the-fly when the initial OAuth request has no existing session cookie. This supports IdP-initiated SSO flows while preserving CSRF protection (the state parameter is still bound to the session via the browser's cookie jar). The same guard is needed on the callback branch's check_csrf call â if the cookie is missing on callback, redirect with an error instead of crashing. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 48

[Bug 43246] New: Entering dates with a keyboard creates due dates with time set to 00:00
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43246 Bug ID: 43246 Summary: Entering dates with a keyboard creates due dates with time set to 00:00 Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: janne.seppanen(a)lahti.fi QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- One can enter due dates manually with the current datepicker in Koha. When picking dates from the calendar widget, Koha creates due dates with 23:59 as the latest return time on that date. However, when entering the date with a keyboard the time sets to 00:00, meaning that if the patron returns their loans on the due date, they're already late. There seems to have been a similar bug with the old date widget, maybe this bug has returned with the release of the new datepicker widget? https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34939 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14

[Bug 43693] New: Mark Library Card as Lost
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43693 Bug ID: 43693 Summary: Mark Library Card as Lost Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: tech.aimee(a)salinapublic.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- Give patrons the ability to mark their library card as lost -- for patron privacy and security. They should not have to wait for the Library's open hours to contact staff, especially since cards are connected to digital services and can be used immediately. Potentially in the same way we give the ability for patrons to self-register or change account contact information, their card should be marked as lost, in the event that the card is misplaced or stolen (like a credit card). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 39482] New: Link to edit OpacLibraryInfo from library edit page broken
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39482 Bug ID: 39482 Summary: Link to edit OpacLibraryInfo from library edit page broken Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com When editing a library which has OpacLibraryInfo defined there is a link in the form "Edit HTML content". The link passes the wrong id parameter, resulting in an incorrect entry being edited. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 48

[Bug 40597] New: Changes to borrower relationships should be logged
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40597 Bug ID: 40597 Summary: Changes to borrower relationships should be logged Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: enica(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com When linking and unlinking borrower relationships, it is currently not logged in Koha. The only thing that is currently logged are changes to the borrowers table. It would be nice to have this logged. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 43695] New: ISO 18626 agency identifiers are hardcoded to sup_agency_value / req_agency_value
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43695 Bug ID: 43695 Summary: ISO 18626 agency identifiers are hardcoded to sup_agency_value / req_agency_value Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: minhpq(a)tinhvan.com QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com, pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Target Milestone: --- Split out of bug 43674 comment #2 at Pedro Amorim's request. Koha/ILL/ISO18626/Request.pm builds the supplyingAgencyMessage payload with both agency identifiers hardcoded: agencyIdValue => 'sup_agency_value', # line 352 agencyIdValue => 'req_agency_value', # line 359 Impact The requesting agency cannot tell which library the message came from. Testing against a third-party implementation, every supplyingAgencyMessage from Koha arrived with supplyingAgencyId = "sup_agency_value" which matches no configured partner, so there is no way to verify the sender. This matters more for supplyingAgencyMessage than for the other message types. ISO 18626 puts requestingAgencyAuthentication in request and requestingAgencyMessage, but has no equivalent element for supplyingAgencyMessage — the agency identifier is the only thing in that message that says who sent it. With it hardcoded, a receiver has two options, both bad: trust any sender, or fall back to matching the transaction on requestingAgencyRequestId alone, which is what we had to do. Suggested fix The supplying agency identifier is the library's own, so it belongs in configuration — one value per Koha instance rather than per partner. The requesting agency identifier is already known per partner: bug 37762 stores each requesting agency in iso18626_requesting_agencies, which has a `type` column (DNUCNI/ICOLC/ISIL) but no identifier value column, so that would need one too. Note the same defect exists in the out-of-tree plugin, reported separately at https://github.com/openfifth/koha-ill-iso18626/issues/8 with a patch at https://github.com/openfifth/koha-ill-iso18626/pull/5. The approach taken there was: `requesting_agency_id` / `requesting_agency_id_type` for the library itself, and `agency_id` / `agency_id_type` per partner. Core may well want something different given it already has iso18626_requesting_agencies, but the shape of the problem is the same. How it was found Interoperability testing between Koha 26.05.02 and a third-party ISO 18626 implementation generated from the official v1.2 XSD. Related: bug 43674 (envelope, patched), bug 43694 (element order), bug 37762 (where the supplying side was added). Happy to test a patch for this against the same setup. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 37762] New: Expand ILL to allow for Supplying Agency/Lending Library workflows
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37762 Bug ID: 37762 Summary: Expand ILL to allow for Supplying Agency/Lending Library workflows Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com Currently Koha's ILL module allows for the Koha library to be a borrowing library/institution but does not currently allow for the Koha library to be a supplying agency/lending library. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 117

[Bug 14806] Action Log for Modifying borrower messaging preferences
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14806 Lari Strand <lmstrand(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162961|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14806] Action Log for Modifying borrower messaging preferences
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14806 --- Comment #19 from Lari Strand <lmstrand(a)gmail.com> --- Created attachment 207078 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207078&action=e… Bug 14806: Log message preference changes to action logs Test plan: 1. Go to Patrons -> Edit any patron 2. Go to Messaging preferences tab 3. Update messaging preferences (e.g., change transport method, enable/disable notifications) 4. Save changes 5. Go to Tools -> Logs and verify that action logs show the messaging preference changes 6. Verify log entries show before/after values for changed preferences in diff column 7. Run the test suite: prove t/Members_Messaging.t => PASS 8. Verify that preference changes are correctly logged with the patron borrowernumber 9. Test with patron category defaults too Sponsored-by: Koha-Suomi Oy -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14806] Action Log for Modifying borrower messaging preferences
by bugzilla-daemon＠bugs.koha-community.org 01 Oct '26

01 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14806 Lari Strand <lmstrand(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff Sponsorship status|--- |Sponsored Comma delimited| |Koha-Suomi Oy list of Sponsors| | Assignee|lari.taskula(a)hypernova.fi |lmstrand(a)gmail.com --- Comment #18 from Lari Strand <lmstrand(a)gmail.com> --- Bug 14806: Log message preference changes to action logs Test plan: 1. Go to Patrons -> Edit any patron 2. Go to Messaging preferences tab 3. Update messaging preferences (e.g., change transport method, enable/disable notifications) 4. Save changes 5. Go to Tools -> Logs and verify that action logs show the messaging preference changes 6. Verify log entries show before/after values for changed preferences in diff column 7. Run the test suite: prove t/Members_Messaging.t => PASS 8. Verify that preference changes are correctly logged with the patron borrowernumber 9. Test with patron category defaults too Sponsored-by: Koha-Suomi Oy -- You are receiving this mail because: You are watching all bug changes.

1 0