https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #615 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Hi all, I've confirmed 7 blockers which affect parts of Koha outside the display module or are security related. An additional 7 findings contained solely within the module itself were found, but are left out of this comment for now. B1: Fresh install fails 1) Run: sed -n 33,34p installer/data/mysql/mandatory/userflags.sql 2) Confirm the (33, 'item_lists', ...) line has no comma before the (34, 'displays', ...) line 3) Run a fresh install. Confirm it fails with an SQL syntax error in userflags.sql B2: DisplayItemsLog is not added on upgrade 1) Apply patches, updatedatabase and restart plack 2) Go to Reports > 'Create from SQL' and run: SELECT variable FROM systempreferences WHERE variable IN ('UseDisplayModule','DisplayItemsLog') 3) Confirm only 'UseDisplayModule' is returned 4) Run: prove t/db_dependent/check_sysprefs.t 5) Confirm 'Compare database with sysprefs.sql file' fails at 'DisplayItemsLog', and the test then dies at line 101 B3: GET /api/v1/library_groups returns a 500 1) Apply patches, updatedatabase and restart plack 2) Go to Administration > Library groups (http://localhost:8081/cgi-bin/koha/admin/library_groups.pl) 3) Click the 'New group' button, enter any 'Title' and click 'Save' 4) Visit http://localhost:8081/api/v1/library_groups 5) Confirm it returns a 500 error 6) Run: prove t/db_dependent/api/v1/library_groups.t 7) Confirm it fails B4: MARC export changes for every site, even with the module off 952$7 is meant to carry the item's own stored value. That is what gets exported, harvested and indexed alongside the separate item type data. The patches now write the computed 'not for loan' status (which falls back to the item type) into it, on every site, regardless of 'UseDisplayModule'. So anything downstream that reads $7 gets a value that isn't in the database. 1) Before applying the patch, open biblio 46 (http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=46) 2) Click 'Save' > 'MARCXML'. Confirm each 952 has subfield 7 '0' 3) Apply patches, updatedatabase and restart plack 4) Confirm 'UseDisplayModule' is set to 'Don't use' (the default) 5) Repeat 2). Confirm subfield 7 is now '1' (the VM item type's 'Not for loan'), while the items' own 'Not for loan' is still 0 B5: Item details page loses information for every site 1) Before applying the patch, go to Administration > Item types, edit 'BK', tick 'Bookable' and save 2) Open biblio 1 > 'Items' tab (http://localhost:8081/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=1) 3) Confirm item 3999900000001 shows 'Shelving location: General stacks' and 'Item type bookable: Yes' 4) Apply patches, updatedatabase and restart plack 5) Repeat 2). Confirm the 'Shelving location' line is gone and it says 'Item type bookable: No' B6: The REST API saves the display, then returns 403 1) Apply patches, updatedatabase, run 'yarn api:bundle' and 'koha-plack --restart kohadev' 2) Go to Patrons > 'New patron' > 'Staff' and create one at library 'Centerville' with username 'displaytest' and password 'Kohatest123' 3) Click 'More' > 'Set permissions'. Tick 'catalogue', and under 'displays' tick 'add_displays' and 'view_displays'. Save 4) Run: curl -s -u koha:koha -G http://localhost:8081/api/v1/displays --data-urlencode 'q={"display_name":"B6"}' 5) Confirm it returns [] 6) Run: curl -s -o /dev/null -w '%{http_code}\n' -u displaytest:Kohatest123 -X POST http://localhost:8081/api/v1/displays -H 'Content-Type: application/json' -d '{"display_name":"B6","display_branch":"MPL","display_days":7,"start_date":"2026-11-10","end_date":"2026-12-10","display_return_over":"no","enabled":true}' 7) Confirm it prints 403 8) Repeat 4). Confirm display 'B6' with display_branch 'MPL' was created anyway B7: Stored XSS through the display name and notes 1) Apply patches, updatedatabase, run 'yarn api:bundle' and 'yarn build', and restart plack 2) Set 'UseDisplayModule' to 'Use' 3) Go to 'Displays' (http://localhost:8081/cgi-bin/koha/display/display-home.pl) and click the 'New display' button 4) Enter 'Name' <img src=x onerror=alert('name')>, 'Staff note' <img src=x onerror=alert('note')>, 'Duration of display' 7, 'Start of display' today, 'End of display' a month from now, any 'Check in behavior', and 'Enabled' Yes 5) Click 'Add new display item', enter barcode 3999900000001 and 'Date added' today. Save 6) Open biblio 1 (http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=1) 7) Confirm both alerts fire Nits: - BaseResource.vue gets new CSS for vue-select dropdowns with "/* TODO: is there a better way to do this? */". The style block is not scoped, so the rules apply to every vue-select in every Vue module that loads BaseResource, not only Displays. - DisplaysBatchAddItems.vue and DisplaysBatchRemoveItems.vue build their fields by hand. FormElement should be used instead. -- You are receiving this mail because: You are watching all bug changes.