- Koha-bugs - lists.koha-community.org

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42253 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00,25.11.04,25.05.10, |26.05.00,25.11.04,25.05.10, released in|24.11.15 |24.11.15,22.11.37 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42253 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00,25.11.04,25.05.10, |26.05.00,25.11.04,25.05.10, released in|24.11.15,22.11.37 |24.11.15 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

1 0

[Bug 41674] New: Add template plugin for linking to system preferences based on user permission
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41674 Bug ID: 41674 Summary: Add template plugin for linking to system preferences based on user permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org There are many places in templates where we link to a system preference and we are inconsistent about whether these links are dependent on the permission of the logged-in user. I propose to add a template plugin which handles the permission check. [% "RequireChoosingExistingAuthority" | html | $LinkPref %] For a user with 'CAN_user_parameters_manage_sysprefs' permission it outputs: <a class="link_preference" href="admin/preferences.pl?op=search&ok=Search&searchfield=RequireChoosingExistingAuthority">RequireChoosingExistingAuthority</a> For a user without permission it outputs: <span class="link_preference">RequireChoosingExistingAuthority</span> -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 42978] New: Renewal window
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42978 Bug ID: 42978 Summary: Renewal window Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- Should renewals have a window of time (both manual and auto) for renewals, in order to prevent checkout abuse. Consider, you have ManualRenewalPeriodBase set to "the old duedate of the checkout". You check it out, and the patron or staff at some point before it is due hits renewal (either on accident or on purpose). For this scenario, lets say it is done right after checkout. This could effectively work around limits to not renew if the item goes on hold. If the library allows a couple of renewals, this prevents bringing the item back sooner if others are waiting for the item. I haven't seen such a window, but allowing a window of x number of days before and after the due date to renew would make sense, to limit people gaming the checkout period. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 42917] New: Error when changing existing hold from item/record level with only place_holds permission
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42917 Bug ID: 42917 Summary: Error when changing existing hold from item/record level with only place_holds permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com Target Milestone: --- To recreate: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to change the hold from record to item, or vice versa. 4/ See popup: There was an error:error Forbidden -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 39027] New: News are order with older on top
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39027 Bug ID: 39027 Summary: News are order with older on top Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: marion.durand(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org When a news is created, it is displayed last in the news list at the OPAC. You can change that behaviors by using the field 'Number' to order them manually but then, you have to manually edit all news to add a new one first. -- You are receiving this mail because: You are watching all bug changes.

1 35

[Bug 41445] New: Wrong info about holds selection after hold suspending
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41445 Bug ID: 41445 Summary: Wrong info about holds selection after hold suspending Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: roman.dolny(a)jezuici.pl QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com After suspending a hold at patron's holds tab, incorrect information about holds selection is displayed. To reproduce: 1. Have unsuspended hold(s). 2. Go to patron's account, "Details" or "Check out", and "Holds" tab. 3. Click "Suspend" button in "Suspend?" column and confirm modal. 4. Notice: 4.1 checked header checkbox (first column) - not correct, checkbox(es) below are not checked 4.2 number of holds selected in line below the holds table - not correct, checkbox(es) above are not checked, buttons "Cancel selected" and "Suspend selected" are active -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 35

[Bug 42960] New: Database update 25.12.00.059 attempts Elasticsearch mapping update when SearchEngine is Zebra
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42960 Bug ID: 42960 Summary: Database update 25.12.00.059 attempts Elasticsearch mapping update when SearchEngine is Zebra Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Installation and upgrade (command-line installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: mark(a)hofstetter.at QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Target Milestone: --- When upgrading a Koha instance to 26.05, db revision 25.12.00.059 (Bug 40658 - Ensure local-number is sortable) unconditionally instantiates Koha::SearchEngine::Elasticsearch::Indexer and calls update_mappings(). This happens even when the instance has SearchEngine = Zebra. On a Zebra-only instance without Elasticsearch configured, koha-upgrade-schema fails and blocks the entire schema upgrade: Upgrade to 25.12.00.059: Bug 40658 - Ensure local-number is sortable ERROR: Exception 'Koha::Exception' thrown 'Unable to update mappings for index "koha_lise_biblios". Reason was: "". Index needs to be recreated and reindexed' Reproduced in koha-testing-docker with KOHA_IMAGE=26.05, SearchEngine=Zebra, by resetting Version to 25.1200058 and setting local-number sort=0. Expected behavior: - The DB revision should still set search_marc_to_field.sort = 1. - Elasticsearch mappings should only be updated if SearchEngine is Elasticsearch. - Zebra-only instances should not require Elasticsearch to complete koha-upgrade-schema. Proposed fix: Guard the Elasticsearch mapping update with: if ( C4::Context->preference('SearchEngine') eq 'Elasticsearch' ) { ... } and report that the ES mapping update was skipped otherwise. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 42235] New: On OPAC messaging preferences page table header contains no text
by bugzilla-daemon＠bugs.koha-community.org 01 Jul '26

01 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42235 Bug ID: 42235 Summary: On OPAC messaging preferences page table header contains no text Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Accessibility Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: martin.renvoize(a)openfifth.co.uk, matt.blenkinsop(a)openfifth.co.uk, oleonard(a)myacpl.org To recreate: 1. Log into the OPAC 2. Go to "Messaging" 3. The first column's th in the table contains no text. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 18