[Bug 43296] New: Circulation statistics do not work with non-numeric patron attribute codes
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Bug ID: 43296 Summary: Circulation statistics do not work with non-numeric patron attribute codes Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: slavashishkin@gmail.com QA Contact: testopia@bugs.koha-community.org CC: lisette@bywatersolutions.com Depends on: 42735 Target Milestone: --- Bug42735 restricted patron attribute codes in circulation statistics to numeric values. Existing attributes with alphanumeric codes, such as SHOW_BCODE, no longer pass validation. When selected as a row, Koha silently falls back to branch and produces incorrect statistics. When selected as a column, Koha falls back to datetime and may fail with a datetime isn't in GROUP BY DBI error. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 [Bug 42735] [CVE-2026-70373] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Slava Shishkin <slavashishkin@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #1 from Slava Shishkin <slavashishkin@gmail.com> --- Created attachment 203632 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203632&action=edit Bug 43296: Allow alphanumeric patron attributes in circulation stats Allow letters, numbers and underscores in patron attribute codes used by `Row`, `Column` and `Filter_borrower_attributes` parameters. Test plan: 1. Go to Reports > Statistics wizards > Circulation. 2. Select Issuing library as Row and `SHOW_BCODE` as Column. 3. Submit the report. 4. Report fails with "datetime isn't in GROUP BY" DBI error. 5. Select `SHOW_BCODE` as Row and Home library as Column. 6. Result incorrectly uses branch / `items.homebranch`. Apply the patch 7. Restart Plack (`sudo koha-plack --restart kohadev`) 8. Repeat steps 2 and 3. 9. Confirm that the report succeeds and uses branch / `SHOW_BCODE`. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal Keywords| |regression -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |slavashishkin@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Planning to look at this one. Hopefully today. Otherwise next week. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #3 from Jonathan Druart <jonathan.druart@gmail.com> --- Or simply `\w+`? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #4 from Slava Shishkin <slavashishkin@gmail.com> --- Yes, \w+ is sufficient here and also supports non-ASCII patron attribute codes. Updated patch attached. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Slava Shishkin <slavashishkin@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #203632|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #5 from Slava Shishkin <slavashishkin@gmail.com> --- Created attachment 204057 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204057&action=edit Bug 43296: Allow alphanumeric patron attributes in circulation stats Allow letters, numbers and underscores in patron attribute codes used by `Row`, `Column` and `Filter_borrower_attributes` parameters. Test plan: 1. Go to Reports > Statistics wizards > Circulation. 2. Select Issuing library as Row and `SHOW_BCODE` as Column. 3. Submit the report. 4. Report fails with "datetime isn't in GROUP BY" DBI error. 5. Select `SHOW_BCODE` as Row and Home library as Column. 6. Result incorrectly uses branch / `items.homebranch`. Apply the patch 7. Restart Plack (`sudo koha-plack --restart kohadev`) 8. Repeat steps 2 and 3. 9. Confirm that the report succeeds and uses branch / `SHOW_BCODE`. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #204057|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #6 from David Nind <david@davidnind.com> --- Created attachment 204067 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204067&action=edit Bug 43296: Allow alphanumeric patron attributes in circulation stats Allow letters, numbers and underscores in patron attribute codes used by `Row`, `Column` and `Filter_borrower_attributes` parameters. Test plan: 1. Go to Reports > Statistics wizards > Circulation. 2. Select Issuing library as Row and `SHOW_BCODE` as Column. 3. Submit the report. 4. Report fails with "datetime isn't in GROUP BY" DBI error. 5. Select `SHOW_BCODE` as Row and Home library as Column. 6. Result incorrectly uses branch / `items.homebranch`. Apply the patch 7. Restart Plack (`sudo koha-plack --restart kohadev`) 8. Repeat steps 2 and 3. 9. Confirm that the report succeeds and uses branch / `SHOW_BCODE`. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #204067|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #7 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 204084 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204084&action=edit Bug 43296: Allow alphanumeric patron attributes in circulation stats Allow letters, numbers and underscores in patron attribute codes used by `Row`, `Column` and `Filter_borrower_attributes` parameters. Test plan: 1. Go to Reports > Statistics wizards > Circulation. 2. Select Issuing library as Row and `SHOW_BCODE` as Column. 3. Submit the report. 4. Report fails with "datetime isn't in GROUP BY" DBI error. 5. Select `SHOW_BCODE` as Row and Home library as Column. 6. Result incorrectly uses branch / `items.homebranch`. Apply the patch 7. Restart Plack (`sudo koha-plack --restart kohadev`) 8. Repeat steps 2 and 3. 9. Confirm that the report succeeds and uses branch / `SHOW_BCODE`. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pedro.amorim@openfifth.co.u | |k Status|Passed QA |Failed QA --- Comment #8 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- The regex now accepts \w+, but the bug title says "non-numeric," not "non-\w." borrower_attribute_types.code has no character restriction anywhere in the stack, so a code with a hyphen, dot, or space still isn't recognised, falls back to datetime, and hits the same DBI crash reported here. Steps to reproduce: 1. Go to <staff_url>/cgi-bin/koha/admin/patron-attr-types.pl?op=add_form 2. Create a patron attribute type with code SHOW-BCODE (hyph. 3. Go to <staff_url>/cgi-bin/koha/reports/issues_stats.pl 4. Select 'Issuing library' as Row and SHOW-BCODE as Column. 5. Submit the report. 6. Same error as before the patch: DBI Exception: ... 'koha_kohadev.statistics.datetime' isn't in GROUP BY. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Slava Shishkin <slavashishkin@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #9 from Slava Shishkin <slavashishkin@gmail.com> --- Created attachment 204787 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204787&action=edit Bug 43296: Support valid patron attribute codes in circulation stats Circulation statistics only recognise numeric patron attribute codes, while patron attribute type codes are not restricted to numbers. Validate Row, Column and Filter_borrower_attributes against the available patron attribute types. Use generated SQL aliases and pass attribute codes as bind parameters. Test plan: 1. In Administration > Patron attribute types, create attribute types with codes SHOW-BCODE, SHOW.BCODE, SHOW BCODE and SQL); DROP TABLE borrowers; --.. 2. Go to Reports > Statistics wizards > Circulation. 3. Use each attribute as Row and Column with an ordinary field on the other axis. 4. Confirm the report fails or uses the wrong field. Apply the patch. 5. Restart Plack. 6. Repeat steps 3-4. 7. Confirm the reports succeed and use the selected patron attribute. 8. Test the same attributes as filters. 9. Confirm ordinary Row, Column and Filter fields still work. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #10 from Slava Shishkin <slavashishkin@gmail.com> --- The patch now handles valid patron attribute codes without relying on a regex. Codes are validated against the available patron attribute types and passed as bind parameters, with generated aliases used in the SQL. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Patch doesn't apply -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Slava Shishkin <slavashishkin@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #204084|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Slava Shishkin <slavashishkin@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #11 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Putting this back in the queue. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #204787|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #12 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Created attachment 205329 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205329&action=edit Bug 43296: Support valid patron attribute codes in circulation stats Circulation statistics only recognise numeric patron attribute codes, while patron attribute type codes are not restricted to numbers. Validate Row, Column and Filter_borrower_attributes against the available patron attribute types. Use generated SQL aliases and pass attribute codes as bind parameters. Test plan: 1. In Administration > Patron attribute types, create attribute types with codes SHOW-BCODE, SHOW.BCODE, SHOW BCODE and SQL); DROP TABLE borrowers; --.. 2. Go to Reports > Statistics wizards > Circulation. 3. Use each attribute as Row and Column with an ordinary field on the other axis. 4. Confirm the report fails or uses the wrong field. Apply the patch. 5. Restart Plack. 6. Repeat steps 3-4. 7. Confirm the reports succeed and use the selected patron attribute. 8. Test the same attributes as filters. 9. Confirm ordinary Row, Column and Filter fields still work. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43296 --- Comment #13 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org