March 2008 - Koha-devel - lists.koha-community.org

Re: [Koha-devel] Re: [Koha] Follett to Koha 2.2.9 migration help
by Mason James 10 Mar '08

10 Mar '08

On 2008/03/10, at 4:07 PM, Jesse Weaver wrote: > > > > The missing item info you are describing is because Follet's MICROLIF > marc records store their item-info in the 852 fields ( from > memory... ) > (Every ILS vendor have their little quirks about where they stuff the > item-level info, Follets looks to be in 852 > > What is needed is a small script to fetch those Follet 852 item- > values and move them to their corresponding Koha 952 fields, then > write those corrected records out to a new file. > Run Bulkmarcimport.pl on this new file, and you will successfully > pick up those missing item-level values in your Koha marc import. > > > > Can't you just change the marc -> koha links from the 952 subfield > to 852 ones? Granted, this won't work if you have anything that > needs to go into the biblio-level tables (like the itemtype), but > it's worth a shot. > > -- > Jesse Hi Jesse, That is a good idea to test, and the exercise may highlight some subtle mapping bugs in Koha too I'm not quite sure how Koha would behave set up like that, but it would be good to confirm either way. Because i was involved in quite a few ILS to Koha conversions, it made sense to map the various ILS's marc formats to a 'standard' Koha format, rather than creating a custom Koha mapping setup for each client, based on their existing marc format But for a small one-off install by a library, it could make sense to change the Koha mapping to match the existing marc format Cheers, Mason.

1 0

Re: [Koha] HTML not being encoded for display?
by Rick Welykochy 07 Mar '08

07 Mar '08

Chris Cormack wrote: > Short answer is yes, there are more checks on the use side (opac). The > staff interface has some checking, but as Joe pointed out if you have > staff inserting html into your marc data, you have bigger problems. What checks can you do? Characters like "<" and "&" are valid in titles. They cannot be escaped before storing in the database. I could easily imagine a book or article entitled "The danger of <script>s", for example. Joe misses the point with a glib answer "you have bigger problems". First off, staff entering data into the catalogue would hardly be typing in "&" characters maliciously. Rather, they do not know that this is a special character in HTML. Neither should they have to know this. The software must handle it and handle it correctly. Second, more and more Koha instances are now on the Internet. It ain't staff I am worried about. It is cookie and identity thieves who can access the OPAC (P=public) and enter XSS exploits into things like suggestion boxes and registration forms. Innocent staff are caught when they open admin pages that transmit XSS data. And it is their cookies (to the Intranet area) that can then be stolen. This is the fast track to your server being compromised and zombied. > Ill let the other developers answer more fully, but one thing to bear in > mind is that the data is used in more than just a web interface, so > storing things like html entities in the database isnt feasible. Exactly. It takes careful encoding of data which is served up on web pages. The encoding varies, depending on whether the data is inline in text, inside a tag attribute, inside a URL or nested at a 2nd level in any of the above. Not an easy task to get correct. This is why XSS is so prevalent on the Internet. cheers rickw -- ________________________________________________________________ Rick Welykochy || Praxis Services || Internet Driving Instructor A terrorist is someone who has a bomb but can't afford an air force. -- William Blum

1 0

Re: [Koha] HTML not being encoded for display?
by Chris Cormack 07 Mar '08

07 Mar '08

Shifting this over the devel lists, where it can be discussed more fully. Chris On 3/7/08, Chris Hammond-Thrasher <hammondthrasher_c(a)usp.ac.fj> wrote: > > This could be a serious problem. Is this addressed in Koha 3? Are their > any > checks for dangerous user input in Koha 2 or 3? > > -cht > > > > Chris Hammond-Thrasher MLIS CISSP > Library Systems Manager > University of the South Pacific > Suva, Fiji > +679 3232233 > hammondthrasher_c(a)usp.ac.fj > > > -----Original Message----- > From: koha-bounces(a)lists.katipo.co.nz > [mailto:koha-bounces@lists.katipo.co.nz] On Behalf Of Rick Welykochy > Sent: Thursday, 6 March 2008 12:39 PM > To: George Adams > Cc: koha(a)lists.katipo.co.nz > Subject: Re: [Koha] HTML not being encoded for display? > > > George Adams wrote: > > > For example, in the "Add a MARC Record" section, I can enter in a title > (tag 245c) of the following: > > > > My Book is <font size="+5">Great</font> > > > > Sure enough, when the completed MARC record is submitted, the additem.pl > page will show the title with the word "Great" really big. Once added to > the catalog, it will show up in the search engines with that word really > big > as well. > > > > Surely everything entered by users and librarian in the OPAC and > Intranet > sites should be HTML-encoded if it's going to be redisplayed, right? Did > I > miss some setting in the Administration menus that would disallow HTML > from > being entered in a form, or is this a fairly big bug? > > > This is why Koha is susceptible to cross-site scripting attacks, as > already > raised by someone else on this list a few months back. > > Example: > > My book is <script>alert("Gotcha!")</script> > > > cheers > rickw > > > > -- > ________________________________________________________________ > Rick Welykochy || Praxis Services || Internet Driving Instructor > > A terrorist is someone who has a bomb but can't afford an air force. > -- William Blum > _______________________________________________ > Koha mailing list > Koha(a)lists.katipo.co.nz > http://lists.katipo.co.nz/mailman/listinfo/koha > > _______________________________________________ > Koha mailing list > Koha(a)lists.katipo.co.nz > http://lists.katipo.co.nz/mailman/listinfo/koha >

1 0

Upgrade to HTML::Template::Pro 0.69 needed
by Chris Nighswonger 06 Mar '08

06 Mar '08

I am planning to submit a patch to picture-upload.tmpl that implements the TMPL_ELSIF tag new to Template::Pro 0.69. The installer has already been updated to check for 0.69 as a prerequisite, but for those running a developer install this will not catch that. So if templates begin misbehaving, check the version of Template::Pro installed. Regards, Chris -- Chris Nighswonger Faculty Member Network & Systems Director Foundations Bible College & Seminary www.foundations.edu www.fbcradio.org

1 0

Suggesting a change to the developers wiki page: Encoding and Character Sets in Koha
by Michael Hafen 05 Mar '08

05 Mar '08

There is a section: Changing Default Character Sets for MARC21 libraries using UTF-8 Looks like kados added it. The second instruction is: alter table marc_subfield_table modify subfieldvalue BINARY(255); I've tried this and had less than satisfactory results. In MySQL there is a VARBINARY data type that provides better results with this operation. Someone with a login on the wiki please change BINARY(255) to VARBINARY(255) on that line? I'm to lazy to register for an account. :) Also I thought some people on the list would like to know about the VARBINARY thing. This type has the same properties as BINARY with the exception of the variable length instead of fixed length. Following the instructions as I found them I ended up with the subfieldvalue column being null padded to 255 characters. To correct this I had to "update marc_subfield_table set subfieldvalue = TRIM( BOTH UNHEX('00') FROM subfieldvalue )" to get the column back to the way I wanted. That query took a little while to run. :) Have a nice day. -- Mike Hafen

1 0

Koha Hosting
by C W Nel 05 Mar '08

05 Mar '08

I am using different Koha databases on the same server, and need to run scripts on each via Crontab. How to tell the script what Database to access? With other words how to handle context in this situation? Thanks for any advice..

2 1

Nomenclature s/Catalogue/Search/ in the Global Nav
by Joshua Ferraro 05 Mar '08

05 Mar '08

Hi folks, I've gotten several requests from folks that complain that 'Catalogue' and 'Cataloguing' are too close to both exist in the global navigation, and it's been suggested that we change 'Catalogue' to 'Search' ... any objections? Cheers, -- Joshua Ferraro SUPPORT FOR OPEN-SOURCE SOFTWARE CEO migration, training, maintenance, support LibLime Featuring Koha Open-Source ILS jmf(a)liblime.com |Full Demos at http://liblime.com/koha |1(888)KohaILS

2 1

Patron Images Database update didn't hit
by Michael Hafen 04 Mar '08

04 Mar '08

Maybe it's just me, but when I pulled down the patron images patch with the database create table it didn't hit the installer page to do the database update. I looked at the updatedatabase.pl file, and it seems that the patronimages update ended up with the same DBversion as the previous update. Maybe something should be done to make sure that doesn't happen. It seems like a tough problem to handle though. Could just skip a version number or two to leave space for other developers, but then the installer would have to check to make sure that previous updates were run for sure. That wouldn't be trivial to implement. Maybe have to leave things the way they are.

4 3

Sample Data is Permanent?
by Ramon Andinach 04 Mar '08

04 Mar '08

Hi All, When installing Koha 3.00 alpha, I let it install some optional data (patron types and libraries etc.) so that I could see what they looked like while adding my own information. I'm finding that some of them are can not be removed. Is this normal? For instance some of the branches, appear to delete normally but stay on the list regardless (e.g. Springfield and Maryland). And some of the patron types already appear to be in use, so I'm not allowed to delete them. Can the sample data be removed so it doesn't get in the way of the real data? Thanks, ramon.

2 1

A Quite Fright of Soft Nightmare in the "Oh my God!" Doubt... (biblioitems is ko and items is ok?)
by Ignacio Javier 03 Mar '08

03 Mar '08

Hi all! Speaking of Koha 3... Are items and biblioitems tables modern and old version of the same "what we want" thing, respectively, or are they complementary tables and both must exist in Koha 3? The doubt comes after purging (truncating, really) biblioitems table, and constating I obtain same resultset in detail.pl script.... Is a doubt that has me very catched in the cathing essence of the doubt, Anyone can tell?, Thanks in advance and greetings, Ignacio Javier Gómez Rodríguez Analista - Programador Tfno: 902905590 - Fax: 981571425 ignacio.gomez(a)coremain.com www.coremain.com

2 1