- Koha-bugs - lists.koha-community.org

[Bug 36192] New: [OMNIBUS] CSRF Protection for Koha
by bugzilla-daemon＠bugs.koha-community.org 26 Sep '26

26 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 Bug ID: 36192 Summary: [OMNIBUS] CSRF Protection for Koha Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Bug 34478 will be pushed soon, this bug will be for tracking remaining work with dependencies etc, more info to follow -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 157

[Bug 37993] New: Having a single EDI EAN account produces a bad redirect
by bugzilla-daemon＠bugs.koha-community.org 26 Sep '26

26 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37993 Bug ID: 37993 Summary: Having a single EDI EAN account produces a bad redirect Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org In acqui/edi_ean.pl: if ( @eans == 1 ) { my $ean = $eans[0]->ean; print $query->redirect( "/cgi-bin/koha/acqui/basket.pl?basketno=$basketno&op=cud-ediorder&ean=$ean" ); } So if you only have the single 'Library EAN' account Koha redirects to: /cgi-bin/koha/acqui/basket.pl?basketno=$basketno&op=cud-ediorder&ean=$ean This causes an error "op 'cud-ediorder' must not start with cud-" -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 59

[Bug 43635] New: run_report.pl does not capture or handle errors
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43635 Bug ID: 43635 Summary: run_report.pl does not capture or handle errors Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com Target Milestone: --- Bug 39164 added a report_sql_max_statement_time_seconds setting to the koha-conf When this limit is reached an error is thrown which is shown in the staff interface: Query execution was interrupted (max_statement_time exceeded) When run_report.pl hits this error the error is warned, but if report is saved it is not saved in saved_reports or emailed if report is being emailed -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 41387] New: Add option for 2 digit month to serial patterns
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41387 Bug ID: 41387 Summary: Add option for 2 digit month to serial patterns Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org The manual says: Numbering formula: this is what is used to create the number for each issue. You can use placeholders for up to three variables {X}, {Y}, and {Z} (which can be defined below), as well as predetermined variables: {Day} will be replaced by the date (two digits) {Month} will be replaced by the month number (two digits) {Year} will be replaced by the year (four digits) {DayName} will be replaced by the name of the day of the week https://koha-community.org/manual/23.11/en/html/serials.html#adding-serial-… But we actually replace the month with a single digit, we should have an option for 2 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 13

[Bug 43642] New: Show metadata repair warnings in the advanced cataloguing editor
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43642 Bug ID: 43642 Summary: Show metadata repair warnings in the advanced cataloguing editor Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Target Milestone: --- To recreate: Add some metadata errors: INSERT INTO biblio_metadata_errors (metadata_id,error_type,tag,subfield,message) VALUES (368,'nonxml_chars',520,"a","Ugly chars"),(368,'empty_datafields',515,"b","Empty headed"); Edit the related record in standard cataloging editor - see the warnings Switch to the advanced cataloging editor: no feedback -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 14806] Action Log for Modifying borrower messaging preferences
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14806 Avery Campbell (Butte County Library (CA)) <acampbell(a)buttecounty.ca.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |acampbell(a)buttecounty.ca.go | |v -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40968] New: 'Edit this search' forgets about 'whole_records' and 'weighted_fields'
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40968 Bug ID: 40968 Summary: 'Edit this search' forgets about 'whole_records' and 'weighted_fields' Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Found it while playing with links on bug 40966. To reproduce: 1. Apply bug 40966 2. Perform an adv search as in that bug. Using the 'More options' tab. 3. Include any of the following options (or both): * Search entire MARC record * Apply field weights to search 4. Notice the facets include 'whole_records=1' and/or 'weighted_fields=1' (this is the bug 40966 patch in action) 5. hover the 'Edit this search' link => SUCCESS: It gets the query parameters passed through 6. Click on the link => FAIL: None is really set, we lost search information. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 15

[Bug 43639] New: Cannot use ElasticsearchMARCFormat because of too many fields
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43639 Bug ID: 43639 Summary: Cannot use ElasticsearchMARCFormat because of too many fields Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- This was in KTD with ES9. Set preference ElasticsearchMARCFormat to searchable array. Reindex Perform any search. Boom: [2026/09/25 16:43:57] [WARN] [Request] ** [http://es:9200]-[400] [query_shard_exception] failed to create query: field expansion matches too many fields, limit: 1024, got: 1060, with: {"index":"koha_kohadev_biblios","index_uuid":"XUtjIIh2TXWiFwf0NaAgqQ"}, [query_shard_exception] failed to create query: field expansion matches too many fields, limit: 1024, got: 1174, with: {"index_uuid":"XUtjIIh2TXWiFwf0NaAgqQ","index":"koha_kohadev_biblios"}, [query_shard_exception] failed to create query: field expansion matches too many fields, limit: 1024, got: 1069, with: {"index_uuid":"XUtjIIh2TXWiFwf0NaAgqQ","index":"koha_kohadev_biblios"}, [query_shard_exception] failed to create query: field expansion matches too many fields, limit: 1024, got: 1046, with: {"index":"koha_kohadev_biblios","index_uuid":"XUtjIIh2TXWiFwf0NaAgqQ"}, [query_shard_exception] failed to create query: field expansion matches too many fields, limit: 1024, got: 1066, with: {"index_uuid":"XUtjIIh2TXWiFwf0NaAgqQ","index":"koha_kohadev_biblios"}, called from sub Search::Elasticsearch::Role::Cxn::process_response at /kohadevbox/koha/Koha/SearchEngine/Elasticsearch.pm line 56. With vars: {'body' => {'error' => {'type' => 'search_phase_execution_exception','root_cause' => [{'index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','index' => 'koha_kohadev_biblios','type' => 'query_shard_exception','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1060'},{'type' => 'query_shard_exception','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1174','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','index' => 'koha_kohadev_biblios'},{'index' => 'koha_kohadev_biblios','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1069','type' => 'query_shard_exception'},{'type' => 'query_shard_exception','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1046','index' => 'koha_kohadev_biblios','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ'},{'type' => 'query_shard_exception','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1066','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','index' => 'koha_kohadev_biblios'}],'reason' => 'all shards failed','grouped' => bless( do{\(my $o = 1)}, 'JSON::PP::Boolean' ),'failed_shards' => [{'index' => 'koha_kohadev_biblios','node' => 'j0qWhv_aT_m6BJl0W0eyRA','shard' => 0,'reason' => {'index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','index' => 'koha_kohadev_biblios','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1060','caused_by' => {'reason' => 'field expansion matches too many fields, limit: 1024, got: 1060','type' => 'illegal_argument_exception'},'type' => 'query_shard_exception'}},{'reason' => {'index' => 'koha_kohadev_biblios','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','type' => 'query_shard_exception','caused_by' => {'reason' => 'field expansion matches too many fields, limit: 1024, got: 1174','type' => 'illegal_argument_exception'},'reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1174'},'shard' => 1,'node' => 'j0qWhv_aT_m6BJl0W0eyRA','index' => 'koha_kohadev_biblios'},{'index' => 'koha_kohadev_biblios','node' => 'j0qWhv_aT_m6BJl0W0eyRA','reason' => {'type' => 'query_shard_exception','caused_by' => {'type' => 'illegal_argument_exception','reason' => 'field expansion matches too many fields, limit: 1024, got: 1069'},'reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1069','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','index' => 'koha_kohadev_biblios'},'shard' => 2},{'index' => 'koha_kohadev_biblios','shard' => 3,'reason' => {'type' => 'query_shard_exception','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1046','caused_by' => {'type' => 'illegal_argument_exception','reason' => 'field expansion matches too many fields, limit: 1024, got: 1046'},'index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ','index' => 'koha_kohadev_biblios'},'node' => 'j0qWhv_aT_m6BJl0W0eyRA'},{'index' => 'koha_kohadev_biblios','shard' => 4,'reason' => {'type' => 'query_shard_exception','reason' => 'failed to create query: field expansion matches too many fields, limit: 1024, got: 1066','caused_by' => {'type' => 'illegal_argument_exception','reason' => 'field expansion matches too many fields, limit: 1024, got: 1066'},'index' => 'koha_kohadev_biblios','index_uuid' => 'XUtjIIh2TXWiFwf0NaAgqQ'},'node' => 'j0qWhv_aT_m6BJl0W0eyRA'}],'phase' => 'query'},'status' => 400},'request' => {'path' => '/koha_kohadev_biblios/_search','body' => {'size' => '20','aggregations' => {'holdingbranch' => {'terms' => {'size' => '20','field' => 'holdingbranch__facet'}},'su-geo' => {'terms' => {'field' => 'su-geo__facet','size' => '20'}},'homebranch' => {'terms' => {'size' => '20','field' => 'homebranch__facet'}},'author' => {'terms' => {'field' => 'author__facet','size' => '20'}},'ccode' => {'terms' => {'field' => 'ccode__facet','size' => '20'}},'itype' => {'terms' => {'size' => '20','field' => 'itype__facet'}},'subject' => {'terms' => {'size' => '20','field' => 'subject__facet'}},'ln' => {'terms' => {'size' => '20','field' => 'ln__facet'}},'title-series' => {'terms' => {'size' => '20','field' => 'title-series__facet'}},'location' => {'terms' => {'size' => '20','field' => 'location__facet'}}},'from' => 0,'sort' => [{'_score' => {'order' => 'desc'}},{'local-number__sort' => {'order' => 'desc'}}],'query' => {'bool' => {'must' => [{'query_string' => {'fields' => ['record-source','identifier-other','other-control-number','lc-card-number','personal-name','local-number','koha-auth-number','arp','date-entered-on-file','number-natl-biblio','musical-presentation','date-of-publication','host-item','cn-suffix','location','date-of-acquisition','report-number','author-personal-bibliography','nlm-call-number','title-abbreviated','conference-name','stack','subject','publisher','note','title-key','geographic-class','issues','replacementprice','acqsource','cn-bib-sort','bio','cn-class','control-number-identifier','udc-classification','ln-subtitle','title-other-variant','interest-grade-level','rtype','number-legal-deposit','ff7-01-02','map-scale','identifier-publisher-for-music','reading-grade-level','index-term-genre','ta','restricted','geolocation_lon','curriculum','cn-sort','lexile-number','totalissues','title-uniform','withdrawn','geolocation_lat','pl','copynumber','ln','homebranch','isbn','reserves','number-local-acquisition','host-item-number','lc-call-number','name','name-geographic','author-name-corporate','title-series','title-cover','cross-reference','record-control-number','music-key','itemtype','holdingbranch','cn-prefix','biblioitemnumber','extent','issn-all','identifier-standard','local-classification','language-original','microform-generation','llength','copydate','nal-call-number','ff8-23','ctype','number-db','related-periodical','barcode','fingerprint-identifier','provider','title-no-punctuation','arl','replacementpricedate','dewey-classification','bnb-card-number','ccode','cn-item','materials-specified','bib-level','number-govt-pub','su-geo','ff7-01','ff7-00','datelastseen','code-institution','ff7-02','renewals','title','author-name-personal','itemnumber','bgf-number','lf','dissertation-information','abstract','title-collective','damaged','classification-source','lost','subject-name-personal','coded-location-qualifier','author','coden','indexed-by','editor','ln-audio','price','itype','title-former','corporate-name','author-title','uri','ff8-29','material-type','stock-number','interest-age-level','issn','thematic-number','index-term-uncontrolled','isbn-all','current-publication-frequency','notforloan','code-geographic','title-expanded','author-in-order','not-onloan-count','datelastborrowed','date-time-last-modified','name-and-title','cn-bib-source','title-later','control-number','marc_data_array.*'],'lenient' => bless( do{\(my $o = 1)}, 'JSON::PP::Boolean' ),'type' => 'cross_fields','analyze_wildcard' => $VAR1->{'request'}{'body'}{'query'}{'bool'}{'must'}[0]{'query_string'}{'lenient'},'fuzziness' => 'auto','query' => '(cat*)','default_operator' => 'AND'}}]}}},'mime_type' => 'application/json','qs' => {'track_total_hits' => 'true'},'serialize' => 'std','ignore' => [],'method' => 'GET'},'status_code' => 400} -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 42881] New: Improve Elasticsearch Indexing performance
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42881 Bug ID: 42881 Summary: Improve Elasticsearch Indexing performance Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- An epic bug to collect elasticsearch (re)indexing performance improvements -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 7

[Bug 43123] New: Hold placement workflow: Vue modernisation (epic)
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '26

25 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43123 Bug ID: 43123 Summary: Hold placement workflow: Vue modernisation (epic) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com Target Milestone: --- This is a tracking bug for a project to replace the staff interface hold placement workflow (reserve/request.pl, reserve/request.tt, js/holds.js) with a set of REST API endpoints and a Vue 3 single page application, addressing severe performance problems in the current implementation. Problem reserve/request.pl (roughly 820 lines) pre-computes holdability for every item on a record, across every policy dimension, in a single synchronous request, then renders the results through a 1600 line Template Toolkit page with jQuery interactivity (js/holds.js, roughly 1300 lines). For a 100 item biblio this produces on the order of 1800 to 2700 SQL queries in a single page load. Confirmed cost centres include: - The same item set is fetched independently by CanBookBeReserved, GetMaxPatronHoldsForRecord, request.pl's own item loop, and (when onshelfholds=2) ItemsAnyAvailableAndNotRestricted. - FixPriority (C4::Reserves) issues one UPDATE per queued hold on every create, cancel or fill. A title with 50 queued holds means 50 UPDATE statements per state change. - Club holds check each enrolled patron's hold count and balance individually, with no batching. - Pickup location computation (Koha::Biblio::pickup_locations) iterates every item and resolves branch and transfer limit rules per item. Some mitigation already exists (CanItemBeReserved and get_effective_rule_value now cache via Koha::Cache::Memory::Lite, and Koha::Biblio::pickup_locations has a per-item-shape cache), but these reduce repeat lookups within a request rather than changing the underlying O(N) shape of the computation. Proposed direction - New availability classes, Koha::Item::Availability::Hold and Koha::Biblio::Availability::Hold, load context for a (patron, biblio) pair once, then evaluate holdability for every item from memory. These follow the pattern already established by bug 41728 (Koha::Item::Availability::Checkin) and its shared Koha::Result::Availability base class, rather than inventing a bespoke schema. - Patron level pre-flight eligibility reuses the existing Koha::Patron->can_place_holds method (already in main), exposed via a new GET endpoint rather than new backend logic. - New REST endpoints expose holdability at the biblio, item, batch and patron level, so the UI asks only for what the current screen needs instead of pre-computing everything up front. - A new Vue 3 single page application replaces reserve/request.tt and js/holds.js, following the existing ERM / Preservation / Acquisitions module pattern, gated behind a new UseNewHoldsInterface system preference (default off) until feature parity is confirmed. - reserve/request.pl remains the default and fully functional throughout the migration. - Separately, Koha's Circulation Holds queue picking list report (circ/view_holdsqueue.pl) is being made API driven by bug 42503. That bug is not a Vue conversion. Once it lands, this epic includes a small follow on to render that page with Vue against the endpoint it introduces, without duplicating its REST work. This bug tracks the overall initiative. Individual patches are delivered against the bugs it depends on, listed below, each independently testable and each landing without changing default behaviour until the bug that flips the feature flag. This bug is not expected to carry a patch itself. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 9