June 2015 - Koha-devel - lists.koha-community.org

Re: [Koha-devel] QA script - New check for spelling
by Mark Tompsett 25 Jun '15

25 Jun '15

Greetings, Christopher Nighswongerchris.nighswonger(a)gmail.com wrote: > Of course if we stick to using US English (or whatever, really) > as the default, that should really not be an issue. Agreed. > Seems like we've been down this road before. This patch makes the road more apparent. This may or may not be pleasant for some people. Languages, even dialects of English, are a politically charged mess. I won’t even go into localization issues. GPML, Mark Tompsett

1 0

RFC: Reverting MARC batches with deleted records
by Kyle Hall 23 Jun '15

23 Jun '15

The batch record tool can A) overlay/replace existing records B) revert batches, including modifications due to overlays The situation becomes messy when we begin dealing with batches having overlaid records that are now deleted. If one of these batches is reverted, the record is un-deleted and the old pre-overlay record is reinstated ( unless you have CatalogingLog on, then nothing happens do to a bug ). The question becomes, is this the correct thing to do? If a record is deleted, shouldn't it stay deleted? Please let me know what you think! Kyle http://www.kylehall.info ByWater Solutions ( http://bywatersolutions.com ) Meadville Public Library ( http://www.meadvillelibrary.org ) Crawford County Federated Library System ( http://www.ccfls.org ) Mill Run Technology Solutions ( http://millruntech.com )

3 3

Security release - Koha 3.16.12
by Mason James 23 Jun '15

23 Jun '15

The Koha release team would like to announce the release of Koha 3.16.12. This is a security release. We strongly recommend people running a 3.16 series Koha to upgrade as soon as possible. Special thanks also goes to Raschin Tavakoli and Dimitris Simos from SBA Research for finding and reporting the security bugs. Please go tohttp://koha-community.org/security-release-koha-3-16-12 <http://koha-community.org/security-release-koha-3-20-1/> to read the full release notes. Cheers, Mason.

1 0

Escaping single quotes in template variables
by David Cook 23 Jun '15

23 Jun '15

Hi all: It looks like we're not validating the data that goes into "cardnumber". This causes problems in at least one spot (in members-toolbar.inc, which is loaded by circulation.pl). If the cardnumber contains an apostrophe, you'll get an Uncaught SyntaxError in the javascript function confirm_reregistration. Unfortunately, using the "uri" filter won't fix this problem: "As of version 2.26 of the Template Toolkit, the uri and url filters use the unsafe character set defined by RFC3986. This means that certain characters ("(", ")", "~", "*", "!" and the single quote "'") are now deemed unsafe and will be escaped as hex character sequences. The double quote character ('"') is now deemed safe and will not be escaped" (http://template-toolkit.org/docs/manual/Filters.html#section_uri) The required version in Koha is 2.22 and the version in Debian appears to be 2.24. I'm currently using 2.25. So I'm not really sure where to go from here but here are some ideas: 1) Upgrade Template Toolkit to 2.26 (possibly not so easy from a Debian perspective [Robin might want to chime in on that one], and who knows what else has been changed between 2.24 and 2.26? The readme on Github isn't super comprehensive https://github.com/abw/Template2) 2) Replace the single quote in the template with an encoded single quote (not very elegant and possibly a bit annoying to maintain) 3) URI encode the data in the .pm or .pl (I rather not handle display template logic in the actual Perl. Plus, cardnumber is passed opaquely to the template via "$template->param(%$borrower);" at the moment) 4) Limit the data allowed as a cardnumber (this is probably the hardest thing to do because a borrower can be created in a few different ways. which might make reporting data validation errors more or less difficult.) 5) We could write our own Template Toolkit Filter class that escapes the most comprehensively What does the Koha brain trust think? David Cook Systems Librarian Prosentient Systems 72/330 Wattle St, Ultimo, NSW 2007

2 1

Security release - Koha 3.18.8
by Liz Rea 23 Jun '15

23 Jun '15

The Koha release team would like to announce the release of Koha 3.18.8 this is a security and a bugfix release. Of special note in this release is that 3.18 is now compatible with Debian Jessie. Go forth and upgrade your Squeeze boxes, ye users of 3.18! As such we strongly recommend people running 3.18 should upgrade as soon as possible Special thanks also goes to Raschin Tavakoli and Dimitris Simos from SBA Research for finding and reporting the security bugs. Please go to http://koha-community.org/security-release-koha-3-18-8/ <http://koha-community.org/security-release-koha-3-20-1/> to read the full release notes. Cheers, Liz Rea

1 0

Security release - Koha 3.20.1
by Chris Cormack 23 Jun '15

23 Jun '15

The Koha release team would like to announce the release of Koha 3.20.1, this is a security and a bugfix release. As such we strongly recommend people running 3.20.0 should upgrade as soon as possible Special thanks also goes to Raschin Tavakoli and Dimitris Simos from SBA Research for finding and reporting the security bugs. Please go to http://koha-community.org/security-release-koha-3-20-1/ to read the full release notes Chris

1 0

Koha 3.20.1 slight delay
by Chris Cormack 22 Jun '15

22 Jun '15

As you, we do time based releases so 3.20.1 is due now. However there are a couple of important patches waiting qa that I want to push before the release. So I'm hoping they will get sorted very shortly and I will release as soon as they are. Chris

2 1

We need Koha Naming Standards
by Kyle Hall 22 Jun '15

22 Jun '15

It's been discussed a few times, but I think we need to formalize naming conventions when writing patches for Koha. The worse offenders are those things that we use many different names for both internally and externally. I think patrons/borrowers/members is the worst offender. List come to mind as well ( previously being virtual shelves ). I believe that our internal nomenclature should reflect our outward nomenclature. So if the staff and/or OPAC use the term "patron" we should be using the term "patron" in our code as well, especially for namespaces. What does everyone think? The more we hammer out now the easier it will be to vote on naming rules at the dev meeting. Kyle http://www.kylehall.info ByWater Solutions ( http://bywatersolutions.com ) Meadville Public Library ( http://www.meadvillelibrary.org ) Crawford County Federated Library System ( http://www.ccfls.org ) Mill Run Technology Solutions ( http://millruntech.com )

7 9

How to fix XSS potential attacks? [again]
by Jonathan Druart 22 Jun '15

22 Jun '15

Hi devs, I have already sent a message on the list, 6 months ago [1] There is some news on the bug report [2]. Please go and test it deeply. I would say we should apply the patch on top of master when we develop/test something, it is the only way to test it massively and correctly and guarantee that we won't find a big regression once it will be pushed. Cheers, Jonathan [1] http://lists.koha-community.org/pipermail/koha-devel/2015-January/041113.ht… [2] http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618

1 0

Reminder: next dev meeting 24th June 2015
by Tomas Cohen Arazi 22 Jun '15

22 Jun '15

Hi everyone, this is just a reminder that an important dev meeting is taking place next wednesday. Please take the time to dig into the topics so we can discuss such important thignns with a good basis. Agenda: http://wiki.koha-community.org/wiki/Development_IRC_meeting_24_June_2015 Kind regards -- Tomás Cohen Arazi Prosecretaría de Informática Universidad Nacional de Córdoba ✆ +54 351 5353750 ext 13168 GPG: B76C 6E7C 2D80 551A C765 E225 0A27 2EA1 B2F3 C15F

1 0