[Bug 43296] New: Circulation statistics do not work with non-numeric patron attribute codes
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Bug ID: 43296 Summary: Circulation statistics do not work with non-numeric patron attribute codes Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: slavashishkin@gmail.com QA Contact: testopia@bugs.koha-community.org CC: lisette@bywatersolutions.com Depends on: 42735 Target Milestone: --- Bug42735 restricted patron attribute codes in circulation statistics to numeric values. Existing attributes with alphanumeric codes, such as SHOW_BCODE, no longer pass validation. When selected as a row, Koha silently falls back to branch and produces incorrect statistics. When selected as a column, Koha falls back to datetime and may fail with a datetime isn't in GROUP BY DBI error. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 [Bug 42735] [CVE-2026-70373] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Slava Shishkin <slavashishkin@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #1 from Slava Shishkin <slavashishkin@gmail.com> --- Created attachment 203632 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203632&action=edit Bug 43296: Allow alphanumeric patron attributes in circulation stats Allow letters, numbers and underscores in patron attribute codes used by `Row`, `Column` and `Filter_borrower_attributes` parameters. Test plan: 1. Go to Reports > Statistics wizards > Circulation. 2. Select Issuing library as Row and `SHOW_BCODE` as Column. 3. Submit the report. 4. Report fails with "datetime isn't in GROUP BY" DBI error. 5. Select `SHOW_BCODE` as Row and Home library as Column. 6. Result incorrectly uses branch / `items.homebranch`. Apply the patch 7. Restart Plack (`sudo koha-plack --restart kohadev`) 8. Repeat steps 2 and 3. 9. Confirm that the report succeeds and uses branch / `SHOW_BCODE`. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal Keywords| |regression -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |slavashishkin@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Planning to look at this one. Hopefully today. Otherwise next week. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org