- Koha-devel - lists.koha-community.org

Koha meeting reminder
by Chris Cormack 01 Nov '16

01 Nov '16

Hi All The next Koha meeting is on IRC at 2 November 2016 at 20:00 UTC You can see what that is in your local time here https://www.timeanddate.com/worldclock/fixedtime.html?msg=Koha+IRC+General+… This is an important meeting as we confirm the roles for the 17.05 release Agenda is here https://wiki.koha-community.org/wiki/General_IRC_meeting_2_November_2016 Chris -- Chris Cormack Catalyst IT Ltd. +64 4 803 2238 PO Box 11-053, Manners St, Wellington 6142, New Zealand

1 0

Create autocomplete for addbiblio.pl
by Rodrigo Santellan 01 Nov '16

01 Nov '16

Hi, I'm trying to create an autocomplete for a few fields when adding a biblio. My problem so far is that the ids generated are things like this: *tag_110_subfield_a_361770_300725* (I'm trying to create an author autocomplete). One quick fix for me will be to add to the fields a class containing this: tag_[% subfield_loo.tag %]_subfield_[% subfield_loo.subfield %] Should this will be helpful to anybody else? Is there a better way to do this? Regards

3 3

Creating new template.
by Rodrigo Santellan 31 Oct '16

31 Oct '16

Hi, I want to create a new template for a custom action in the patron details. What I need is to call a web service to update some data of the patron but only is the staff wants (Ideally it will be called on a cron job at midnight). I have two languages English and Spanish, do I need to change both views of the *koha-tmpl/intranet-tmpl* or should I change the English one and the regenerate them? Thanks for any help! Regards Rodrigo

3 8

Bug 16733 and related
by Marcel de Rooy 31 Oct '16

31 Oct '16

Hi all, This bug (and various connected ones) is about making changes in the Debian scripts that make life somewhat easier when you decide to use git on a package install. I realize that this is a somewhat controversial area. Several people do not want git near the Debian installs. I understand their concerns in terms of safety and keeping etc in sync with Koha (to say it shortly). In terms of safety you should indeed protect your staff client (iptables, rewrite rule like bug 16922?) For a production install you should probably only use git to manage custom patches on top of your Koha install. Currently, this bug is just silently ignored. Although more people than just me use gitified package installs (especially for testing). The current approach on bug 16733 may not be the most optimal one. So, I am just triggering the discussion here. How can we go further with some more consensus here or should I just obsolete this line of development ? Thanks for any feedback, Marcel

2 1

Koha Community Newsletter: October 2016
by kohanews 30 Oct '16

30 Oct '16

Fellow Koha users: The Koha Community Newsletter for October 2016 is here: https://koha-community.org/koha-community-newsletter-october-2016/ Many thanks to the folks who submitted articles and news to this month's newsletter. Please feel free to email me with any corrections or suggestions. Thanks! -- Chad Roseburg Editor, Koha Community Newsletter

1 0

Development environment ,
by Karam Qubsi 29 Oct '16

29 Oct '16

*Hi , * I hope if some of you can share what tools you are using to make it easier in developing koha code . Recently I tried to implement koha development installation using vagrant ( https://www.vagrantup.com/) as I loved the way it works with Laravel homestead but I think something was not working with me for koha ( did any of you try vagrant with koha) let's say I have my PC and I have a windows on it , and I have a virtual machine with Debian and koha dev installation . I want to edit koha code from my windows machine using my preferred IDE and then simply from the virtual machine terminal applying patches or commit some changes . is there any way to get it easy like this ? , *Many thanks . * -- *Karam Qubsi*

8 19

Re: [Koha-devel] [Koha] F5 Attacks
by Paul A 28 Oct '16

28 Oct '16

At 01:29 PM 10/26/2016 +0000, Marcel de Rooy wrote: >Content-Language: nl-NL >Content-Type: multipart/alternative; > >boundary="_000_VI1PR0501MB2591816F386E0F9B467A10E1CEAB0VI1PR0501MB2591_" > >More something for the developers list? > >What Philippe here says, makes some sense to me. We could at least try to >do something; what and how is another thing ;) F5 DDoS can/should be mitigated at firewall -- see e.g. <https://debian-administration.org/article/187/Using_iptables_to_rate-limit_…> -- and while I somewhat agree that it would be "nice" for Koha to consider it, I see this more as a "server admin/setup" that has existed for many years now. Best -- Paul > >---------- >Van: Koha <koha-bounces(a)lists.katipo.co.nz> namens Philippe Blouin ><philippe.blouin(a)inlibro.com> >Verzonden: woensdag 26 oktober 2016 14:52 >Aan: Koha list >Onderwerp: Re: [Koha] F5 Attacks > >I disagree. If Koha is offered out of the box, and we take time to fix >security issues, then it's normal for users to expect "basic" attacks to >be taken care of. > >More so, blocking IP is not a possibility if genuine users are involved >using a station from within the library. > >I'm not saying you're wrong that it's mostly sysadmin work and not Koha, >but it doesn't mean nothing can be done. From the apache's threads, I >found nothing useful (mostly derisive comments). But we could at least >talk about it. > >What about having a javascript preventing refresh on the page withing 5 >sec of each other? Needs to be done in a way that the refresh doesn't >restart the timer. > >What about having the OPAC search be code where the refresh will >basically send nothing ? The checkbox are filled, the request is sent >to the backend, but the frontend keeps nothing... I'm just smoking >here, but I'm trying to induce some brainstorming in this interesting topic. > >Philippe Blouin, >Responsable du développement informatique > >Tél. : (888) 604-2627 >philippe.blouin(a)inLibro.com ><<mailto:philippe.blouin@inLibro.com>mailto:philippe.blouin@inLibro.com> > >inLibro | pour esprit libre | <http://www.inLibro.com>www.inLibro.com ><http://www.inLibro.com> >On 10/26/2016 07:13 AM, Jonathan Druart wrote: > > Hi, > > I don't think this can/must be fixed on Koha side. > > It's a sysadmin duty to take care of that. > > I would take a look at fail2ban to parse the web server access logs. But > > make sure not to block your X librarians using the same ip ;) > > > > On Wed, 26 Oct 2016 at 12:28 Pedro Amorim <pjamorim91(a)gmail.com> wrote: > > > >> I have tested this and the stress caused on the server is very severe. It > >> seems that for every request, a new zebra process is created and the > server > >> will only respond when the last one is finished. This ofc will result in > >> time outs and eventually a crash in the server. > >> > >> This is a major critical issue IMO, anyone who knows about this has the > >> power to deny the service of any Koha online without using any additional > >> hacking/attacking software. > >> > >> The Koha I'm working on right now - still in development - is accessed > >> behind a proxy server, and I will attempt to solve the problem through > >> that, by limiting the requests from the same origin with very little time > >> between them. Still, even if I'm successful with this, the problem will > >> still lie in Koha. > >> > >> Anyone with some sort of insight is very welcome. > >> > >> Pedro Amorim > >> > >> 2016-10-26 8:24 GMT+00:00 clint.deckard <clint.deckard(a)frontiers.co.nz>: > >> > >>> I have had this issue appear today. I have attempted to set up > >> mod_evasive > >>> for apache but it doesn't seem to have solved the problem. > >>> I would really appreciate some advice. > >>> Clint. > >>> > >>> > >>> rfblanchard wrote: > >>> > >>>> Assume a basic opac search: > >>>> > <http://..../cgi-bin/koha/opac-search.pl?q=dog&branch_group_l>http://..../cgi-bin/koha/opac-search.pl?q=dog&branch_group_l > >>>> imit=branch%3A349 > >>>> > >>>> This would take about 10 seconds to return the first time. > >>>> > >>>> Assume the user refreshes the results using f5 and keep there finger > >>>> there a > >>>> moment to long (3s): > >>>> This would kill my server for about 1 minute. > >>>> > >>>> Any attacker could easily make the server unresponsive indefinitely by > >>>> simply holding f5 on an opac search. > >>>> > >>>> Any recommendations on how to deal with this problem? > >>>> > >>>> here is a sample from top: > >>>> > >>>> Tasks: 313 total, 3 running, 309 sleeping, 0 stopped, 1 zombie > >>>> %Cpu(s): 93.7 us, 5.2 sy, 0.0 ni, 1.0 id, 0.2 wa, 0.0 hi, 0.0 si, > >>>> 0.0 > >>>> st > >>>> KiB Mem: 16465036 total, 1532492 used, 14932544 free, 63180 buffers > >>>> KiB Swap: 8526844 total, 0 used, 8526844 free. 505124 cached > >>>> Mem > >>>> > >>>> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ > >>>> COMMAND > >>>> 7027 peischo+ 20 0 416164 162924 12756 S 58.8 1.0 0:26.43 > >>>> /usr/share/koha > >>>> 7009 peischo+ 20 0 416800 163524 12756 S 56.5 1.0 0:33.77 > >>>> /usr/share/koha > >>>> 7444 peischo+ 20 0 129832 15216 5900 R 37.2 0.1 0:01.12 > >>>> zebrasrv > >>>> 7445 peischo+ 20 0 129832 15216 5900 R 35.6 0.1 0:01.07 > >>>> zebrasrv > >>>> 1151 mysql 20 0 886564 181096 10808 S 8.6 1.1 1:27.57 > >> mysqld > >>>> 7435 koha 20 0 25892 3272 2528 R 0.3 0.0 0:00.03 top > >>>> 1 root 20 0 176144 5044 3096 S 0.0 0.0 0:01.43 > >>>> systemd > >>>> 2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 > >>>> kthreadd > >>>> > >>>> > >>>> > >>>> -- > >>>> View this message in context: > <http://koha.1045719.n5.nabble>http://koha.1045719.n5.nabble. > >>>> com/F5-Attacks-tp5906098.html > >>>> Sent from the Koha-general mailing list archive at Nabble.com. > >>>> _______________________________________________ > >>>> Koha mailing list <http://koha-community.org>http://koha-community.org > >>>> Koha(a)lists.katipo.co.nz > >>>> > <https://lists.katipo.co.nz/mailman/listinfo/koha>https://lists.katipo.co.nz/mailman/listinfo/koha > >>>> > >>> _______________________________________________ > >>> Koha mailing list <http://koha-community.org>http://koha-community.org > >>> Koha(a)lists.katipo.co.nz > >>> > <https://lists.katipo.co.nz/mailman/listinfo/koha>https://lists.katipo.co.nz/mailman/listinfo/koha > >>> > >> _______________________________________________ > >> Koha mailing list <http://koha-community.org>http://koha-community.org > >> Koha(a)lists.katipo.co.nz > >> > <https://lists.katipo.co.nz/mailman/listinfo/koha>https://lists.katipo.co.nz/mailman/listinfo/koha > >> > > _______________________________________________ > > Koha mailing list <http://koha-community.org>http://koha-community.org > > Koha(a)lists.katipo.co.nz > > > <https://lists.katipo.co.nz/mailman/listinfo/koha>https://lists.katipo.co.nz/mailman/listinfo/koha > >_______________________________________________ >Koha mailing list <http://koha-community.org>http://koha-community.org >Koha(a)lists.katipo.co.nz ><https://lists.katipo.co.nz/mailman/listinfo/koha>https://lists.katipo.co.nz/mailman/listinfo/koha >_______________________________________________ >Koha-devel mailing list >Koha-devel(a)lists.koha-community.org >http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel >website : http://www.koha-community.org/ >git : http://git.koha-community.org/ >bugs : http://bugs.koha-community.org/ --- Maritime heritage and history, preservation and conservation, research and education through the written word and the arts. <http://NavalMarineArchive.com> and <http://UltraMarine.ca>

4 3

Release Team for 17.05
by Katrin 27 Oct '16

27 Oct '16

Hi, we are currently looking for people to fill the various release team roles for the 17.05 release. If you want to contribute as part of the release team, please sign yourself up on the wiki: https://wiki.koha-community.org/wiki/Roles_for_17.05 Elections will be held at the next General IRC meeting on 2 November: https://wiki.koha-community.org/wiki/General_IRC_meeting_2_November_2016 If you have any questions about the roles, please ask away! Katrin

1 0

Using Elasticsearch for patrons
by Jonathan Druart 27 Oct '16

27 Oct '16

Hi devs, I have played a bit more with Elasticsearch during the last couple of days. I've tried to index and search patron records using it. The patches are on bug 17500, see comment 7. As always, I welcome your comments and input. Cheers, Jonathan https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17500

1 0

Next dev meeting schedule
by Jonathan Druart 27 Oct '16

27 Oct '16

Hi devs, I have already asked twice, but apparently it did not get your attention. You must answer this poll if you are interested in attending dev meetings: https://framadate.org/3dAEB8zqQLzzTptD It(s not only for the next meeting but for all others as well. The goal is to find 2 schedules to alternate between each in order to satisfy everybody. Please vote! Jonathan

1 0