January 2015 - Koha-devel - lists.koha-community.org

How to fix XSS potential attacks?
by Jonathan Druart 23 Jan '15

23 Jan '15

Hi developers, Is there a way to fix globally XSS problems? We should introduce a default filter for all variables used in templates. I have opened bug 13618 to collect ideas and/or solutions. Feel free to contribute, Jonathan

1 0

Koha 3.18.3 released
by Chris Cormack 22 Jan '15

22 Jan '15

The Koha release team is proud to announce the release of Koha 3.18.3. This is the latest release of the current stable branch of Koha, this is a security and bugfix release. We strongly recommend all 3.18.x users upgrade to this latest version. Extra thanks in this release goes to Carlos Córdova, Larry Letelie, and BSZ-BW for reporting the security issues. As always you can wait for a few hours for the packages to appear at debian.koha-community.org or if you are still running from tarballs you can download them at http://downloads.koha-community.org You can read the full release notes at http://koha-community.org/koha-3-18-3-released/ Chris

1 0

Re: [Koha-devel] 3.18 zebra
by Paul A 22 Jan '15

22 Jan '15

At 11:55 AM 1/22/2015 +1300, you wrote: >Paul A schreef op wo 21-01-2015 om 17:10 [-0500]: > > However, neither OPAC ("Results of search for 'kw,wrdl: smith' No > > results > > found! No results found for that in NMA catalog) nor staff-admin ("No > > results match your search for 'kw,wrdl: smith' in NMA Catalog") can > > find > > anything ... > >First thing to try: > >sudo service koha-common restart Thanks Robin, paul@hood:/usr/sbin$ sudo service koha-common restart * Restarting Koha ILS koha-common Stopping Zebra server for k318 SIP server for k318 not running. * Error: Indexer not running for k318 [fail] So, then it bounced me around looking for indexer, SIP server and Zebra, which all appear to start, but service koha-common restart doesn't appear to want to play: paul@hood:/usr/sbin$ sudo koha-indexer --start k318 * Starting Koha indexing daemon for k318 paul@hood:/usr/sbin$ sudo koha-start-sip k318 Starting SIP server for k318 paul@hood:/usr/sbin$ sudo koha-start-zebra k318 Starting Zebra server for k318 paul@hood:/usr/sbin$ sudo service koha-common restart * Restarting Koha ILS koha-common Zebra already stopped for instance k318. SIP server for k318 not running. * Error: Indexer not running for k318 [fail] Best and again thanks -- Paul --- Paul Adamthwaite, Ph.D., Executive Director --- Canadian Society of Marine Artists 205, Main Street, Picton, Ontario, K0K 2T0, Canada Telephone: 1 613 476 1177 E-mail: <info(a)ultramarine.ca> Web: <http://www.ultramarine.ca> Dedicated to Canadian marine art.

2 3

3.18 zebra
by Paul A 21 Jan '15

21 Jan '15

Please bear with me -- I had no luck sorting out my search speed problem, so did a packet apt-get remove, install (not purge.) All went extremely well, OPAC reported "under maintenance", staff admin (logging in with install name) upgraded the 3.05 database (new as requested by /usr/share/koha/k318-db-request.txt), and both sites are delivering proper pages through Apache (prefork+itk.) But I have a problem with Zebra. Does 'instancename-koha' really have to be a sudoer? If there's a possible quick fix I'll try it, if not I'll start over. k318-koha@hood:/usr/sbin$ koha-start-zebra k318 Invalid option: --user (only works for root) /.../ Starting Zebra server for k318 Invalid option: --user (only works for root) /.../ Something went wrong starting Zebra for k318. k318-koha is a valid user (non sudoer) with pw generated by Koha. I can start Zebra as root, no problem, but then: k318-koha@hood:/usr/sbin$ koha-rebuild-zebra -v -f k318 [N.B. not 'sudo'] k318-koha is not in the sudoers file. This incident will be reported. Something went wrong rebuilding biblio indexes for k318 and I have *not* tried reindexing as root -- ISTR dire warnings not to do so on this list :) I've looked at Bug 13396 and koha-conf.xml complies. I've tried sudo service koha-common restart * Restarting Koha ILS koha-common /.../ Zebra already stopped for instance k318. SIP server for k318 not running. * Error: Indexer not running for k318 zebra-error log reports: 20150121 12:49:39 k318-koha-zebra: client (pid 2132) exited with 1 status 20150121 12:49:39 k318-koha-zebra: client (pid 2133) exited with 1 status 20150121 12:49:39 k318-koha-zebra: client (pid 2134) exited with 1 status 20150121 12:49:39 k318-koha-zebra: client (pid 2135) exited with 1 status 20150121 12:49:39 k318-koha-zebra: client (pid 2136) exited with 1 status 20150121 12:49:39 k318-koha-zebra: terminating too quickly, waiting 30 seconds but I'm not sure where '-zebra' gets concatenated to the user. Many thanks -- Paul

3 5

Re: [Koha-devel] 3.18 zebra
by Paul A 21 Jan '15

21 Jan '15

Michael, Thank you, I'm on the same track, but being a little bit cautious. Since the packages were introduced (and I have not yet used them in production) a number of warnings have been expressed (e.g. one of our esteemed developers wrote 20-Aug-2013: "Because the packages put koha-common in /etc/cron.d that does the indexing. The fact you have reindexed as root will have mucked up all sorts of permissions, including breaking this cron job.") So what I have been trying to do is imitate the cron job (that is obviously not running as intended.) Basically after env. vars it is: */5 * * * * root test -x /usr/sbin/koha-rebuild-zebra && koha-rebuild-zebra -q $(koha-list --enabled) I was questioning the 'root' (which may in itself be fairly normal for cron jobs) which seems to go against previous advice. The 'test -x' is taken care of (the file does exist), -q defaults to bibs and auths but with no verbosity, so 'koha-rebuild-zebra -v -f k318' seems like a reasonable command line. It's just a question of 'who' does it, and with 'what permissions.' The zebra logs seem to be working OK, but I do not have 'indexer-error.log' anywhere on the system. Best -- Paul At 01:27 PM 1/21/2015 -0700, you wrote: >Ok, I've poked around a bit with the scripts now. > >Looks like the few command-line tools I looked at expect to be run as >root.Â The zebra logging level is hard coded in koha-start-zebra as >'none,fatal,warn' which should be sufficient.Â You probably already know >that the zebra error log is /var/log/koha/k318/zebra-error.logÂ You may >have to edit that script to change the zebra logging level, looks like the >value for verbose logging is 'none,fatal,warn,all' or at least that's the >case for zebraidx.Â I expect zebrasrv to be the same.Â I was wondering >about file-system permissions, but as long as koha-start-zebra is run as >root it takes care of that. > >The 'Indexer not running' error refers to the ><http://rebuild_zebra.pl>rebuild_zebra.pl script, which is started as a >daemon by the koha-indexer command-line tool.Â So there may also be some >error in there somewhere.Â It's log is /var/log/koha/k318/indexer-error.log > >Hope that info helps. > >On Wed, Jan 21, 2015 at 1:02 PM, Michael Hafen ><<mailto:michael.hafen@washk12.org>michael.hafen(a)washk12.org> wrote: >Looks like `koha-start-zebra k318` is one of the command-line tools >provided by the koha-common package.Â I'm guessing the recommended way to >use this too is to run it as root, and it will then sudo to the k318-koha >user to perform the task inside the tool. >Seems there is an error in zebra though.Â There should be a way to start >zebra with more logging, but I'm not that familiar with the command-line >tools.Â Hopefully someone else knows more... > >On Wed, Jan 21, 2015 at 11:42 AM, Paul A ><<mailto:paul.a@navalmarinearchive.com>paul.a(a)navalmarinearchive.com> wrote: >Please bear with me -- I had no luck sorting out my search speed problem, >so did a packet apt-get remove, install (not purge.) All went extremely >well, OPAC reported "under maintenance", staff admin (logging in with >install name) upgraded the 3.05 database (new as requested by >/usr/share/koha/k318-db-request.txt), and both sites are delivering proper >pages through Apache (prefork+itk.) > >But I have a problem with Zebra. Does 'instancename-koha' really have to >be a sudoer? If there's a possible quick fix I'll try it, if not I'll >start over. > >Â Â Â Â k318-koha@hood:/usr/sbin$ koha-start-zebra k318 >Â Â Â Â Invalid option: --user (only works for root) >Â Â Â Â /.../ >Â Â Â Â Starting Zebra server for k318 >Â Â Â Â Invalid option: --user (only works for root) >Â Â Â Â /.../ >Â Â Â Â Something went wrong starting Zebra for k318. > >k318-koha is a valid user (non sudoer) with pw generated by Koha. I can >start Zebra as root, no problem, but then: > >Â Â Â Â k318-koha@hood:/usr/sbin$ koha-rebuild-zebra -v -f k318 [N.B. >not 'sudo'] >Â Â Â Â k318-koha is not in the sudoers file.Â This incident will be >reported. >Â Â Â Â Something went wrong rebuilding biblio indexes for k318 > >and I have *not* tried reindexing as root -- ISTR dire warnings not to do >so on this list :) > >I've looked at Bug 13396 and koha-conf.xml complies. > >I've tried sudo service koha-common restart >Â Â Â Â * Restarting Koha ILS koha-common >Â Â Â Â /.../ Zebra already stopped for instance k318. >Â Â Â Â SIP server for k318 not running. >Â Â Â Â * Error: Indexer not running for k318 > >zebra-error log reports: >20150121 12:49:39 k318-koha-zebra: client (pid 2132) exited with 1 status >20150121 12:49:39 k318-koha-zebra: client (pid 2133) exited with 1 status >20150121 12:49:39 k318-koha-zebra: client (pid 2134) exited with 1 status >20150121 12:49:39 k318-koha-zebra: client (pid 2135) exited with 1 status >20150121 12:49:39 k318-koha-zebra: client (pid 2136) exited with 1 status >20150121 12:49:39 k318-koha-zebra: terminating too quickly, waiting 30 seconds > >but I'm not sure where '-zebra' gets concatenated to the user. > >Many thanks -- Paul > >_______________________________________________ >Koha-devel mailing list ><mailto:Koha-devel@lists.koha-community.org>Koha-devel(a)lists.koha-community.org >http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel >website : <http://www.koha-community.org/>http://www.koha-community.org/ >git : <http://git.koha-community.org/>http://git.koha-community.org/ >bugs : <http://bugs.koha-community.org/>http://bugs.koha-community.org/ > > --- Maritime heritage and history, preservation and conservation, research and education through the written word and the arts. <http://NavalMarineArchive.com> and <http://UltraMarine.ca>

2 1

Koha Dashboard
by Marcel de Rooy 21 Jan '15

21 Jan '15

Hi all, I am looking quite often to Koha Dashboard and would be interested in having the 10 oldest bugs on the dashboard under Needs Signoff and Needs QA to include all bugs (read: also enhancements, new features). Or could we extend by toggling between 10 oldest bugs and 10 oldest reports or something like that? What do you think (and especially Chris, of course) ? Regards, Marcel

2 1

Re: [Koha-devel] [Koha] question serials start date
by Jonathan Druart 20 Jan '15

20 Jan '15

let's continue on koha-devel Hum, Koha::DateUtils looks buggy too: use Modern::Perl; use Koha::DateUtils qw( dt_from_string output_pref ); use DateTime; use DateTime::Format::DateParse; my $date_string = '15/06/1800'; # metric in pref my $dt = dt_from_string( $date_string ); say '1 => ' . output_pref( $dt ) if $dt; $dt = DateTime->new(year => 1800, month => 06, day => 15); say '2 => ' . output_pref( $dt ) if $dt; $date_string = '06/15/1900'; $dt = DateTime::Format::DateParse->parse_datetime( $date_string ); say '3 => ' . output_pref( $dt ) if $dt; $dt = DateTime::Format::DateParse->parse_datetime( $date_string, 'Europe/Paris' ); say '4 => ' . output_pref( $dt ) if $dt; Will display: 2 => 15/06/1800 00:00 The problem comes from DateTime::Format::DateParse. Somebody knows why we use this module instead of generating a DateTime object directly from the DateTime module? 2015-01-20 11:18 GMT+01:00 Jonathan Druart <jonathan.druart(a)biblibre.com>: > Hello Hugo, > > You should try to use Koha::DateUtils, instead of C4::Dates. > I found some occurrences of "1900" in C4::Dates, maybe there are some > stuffs hardcoded in it. > We are going to deprecate C4::Dates. > > Cheers, > Jonathan > > 2015-01-20 10:26 GMT+01:00 Hugo Agud <hagud(a)orex.es>: > > Dear all, > > > > We're experiencing problems filling dates before 1900 in Serial > startdate, > > for dats after 1900 it stores fine the date, but for dates before 1900, > it > > stores fine in mysql but in intranet shows the date you filled + 1900, > then > > you have for example start date 3725. > > > > We have tried to modiy Dates.pm but without success, any suggestions? we > > have not been able to find any bug related > > > > thanks you in advance! > > > > -- > > > > *Hugo Agud - Orex Digital * > > > > *www.orex.es <http://www.orex.es>* > > > > > > Director > > > > Passatge de la Llançadera, 3 · 08338 Premià de Dalt - Tel: 93 539 40 70 > > hagud(a)orex.es · http://www.orex.es/ > > > > > > > > No imprima este mensaje a no ser que sea necesario. Una tonelada de papel > > implica la tala de 15 árboles y el consumo de 250.000 litros de agua. > > > > > > > > Aviso de confidencialidad > > Este mensaje contiene información que puede ser CONFIDENCIAL y/o de USO > > RESTRINGIDO. Si usted no es el receptor deseado del mensaje (ni > > está autorizado a recibirlo por el remitente), no está autorizado a > copiar, > > reenviar o divulgar el mensaje o su contenido. Si ha recibido este > mensaje > > por error, por favor, notifíquenoslo inmediatamente y bórrelo de su > sistema. > > _______________________________________________ > > Koha mailing list http://koha-community.org > > Koha(a)lists.katipo.co.nz > > http://lists.katipo.co.nz/mailman/listinfo/koha >

2 2

Dev Meeting - Wednesday, January 21st, 15 UTC
by Katrin Fischer 18 Jan '15

18 Jan '15

Hi all, Tomas asked me to schedule a developer IRC meeting for Wednesday 21st January, 15 UTC. I will add an agenda to the wiki shortly. Katrin

1 0

Clarification of Plack wiki insructions
by Mark Tompsett 16 Jan '15

16 Jan '15

Greetings, I am trying to set up plack. I found some instructions here: http://wiki.koha-community.org/wiki/Plack "This instructions assume that your Koha checkout is /srv/koha. If it's in some other location, you have to change /srv/koha to correct folder throughout all scripts below. Create following file and call it opac.psgi" Great, except I'm not sure where opac.psgi goes. Let's say I have a git install: /home/mtompset/kohaclone. Where does opac.psgi go? Let's say I have a package install: /usr/share/koha. Where does opac.psgi go? And am I correct to assume that /srv/koha is to be substituted with those either of those paths that I have given? Help and clarification would be appreciated. I'm trying to test my revisions to bug 5010 completely. GPML, Mark Tompsett

4 3

Hackfest in Marseille (breaking news + call for sponsoring)
by Paul Poulain 16 Jan '15

16 Jan '15

Hello everybody, Last year, BibLibre office was "almost too small" for all the great people who came from all around the world. This year, I asked Aix Marseille university (a Koha user & BibLibre customer), and they where happy to provide us some meeting rooms, that, added to BibLibre office, should be enough (they give us a 12 seats meeting room + 2 office where 3 ppl can easily meet/discuss) So, the hackfest, in 2015, will take place in 2 locations: some of us in BibLibre office, some in University. We need only 20mn to go from one place to the other (5mn foot, 2 metro station, 5mn foot). first of all: thank you Aix Marseille. Secondly: if you want to come, don't hesitate, drop me an email !!! A lot of core people will be here : * Our Release Manager Tomas (trip sponsored by BibLibre, Bywatersolutions and Kohala) * Our QA Manager (Katrin) * 4 from Bywater * 2 from PTFS-Europe (still to confirm. PTFS-E, please confirm. And if you want to be 3, or 4, you can ;-) ) * all BibLibre staff (as usual) * at least 1 from Norway (Magnus) * some from Sweden (to be confirmed) MISSING ONES, and it's too bad. can we do something ? I'd really like to have 2 other people at the hackfest: *Owen* and *Chris*. 3 years ago, BibLibre sponsored Owen's trip. This year, we can't, but maybe someone else could ? If this idea pleases you, feel free to make it happen ! Chris, is there a chance that you could join us as well ? (OK, it's obviously traveling to the other side of the world. But you already made it 9 years ago, right ?) (note that I haven't asked Owen nor Chris whether they could join us. But maybe, if someone want to sponsor their trip, that could be a welcomed idea !) -- Paul Poulain, Associé-gérant / co-owner BibLibre, expert du logiciel libre pour les bibliothèques BibLibre, Open Source software for libraries expert

3 2