- Koha-devel - lists.koha-community.org

Release unification: Security fixes and releases
by Mirko Tietgen 04 Sep '16

04 Sep '16

Hello everyone, can we maybe find a consistent way of labelling releases/ fixes "security"? All new releases contain XSS patches… - 3.20 and 3.22 are labelled "security release" in the emails/ release notes - 16.05 is not - 16.05 and 3.20 list the fixes under the headline "Critical bugs/ Koha - 3.22 as "Security bugs fixed" on top of the list - 3.22 features "security" in the release notes headline (and so in the URL in Wordpress) - The others don't The first question is probably… - Is a security release only a special release in between the regular schedule or - is a security release everything that contains patches with security fixes? It seems to me that the second option is more common within the Koha community and personally I'd prefer it. We should shout it at people and make them upgrade. To underline that intention, showing the security fixes seperately on top of the release notes makes sense to me. I propose to… - use the label "security release" in the release notes headline and first paragraph (and Wordpress URL) - mention number of security fixes seperately - display them under the headline "Security bugs fixed" on top of the list …whenever there are patches from "Koha security" in a release. Basically that is what we have in the 3.22.10 release notes: https://koha-community.org/koha-3-22-10-security-release/ Does that make sense? Any reasons not to do it? Is it harming artistic freedom of RMaints? Would it complicate stuff a lot? I think it would be a good thing to have some consistency here. Cheers, Mirko -- Mirko Tietgen mirko(a)abunchofthings.net http://koha.abunchofthings.net http://meinkoha.de

4 4

Koha::* business objects authorization check
by Tomas Cohen Arazi 31 Aug '16

31 Aug '16

Hi everyone, adding to the discussion about Koha::Objects I have a subject that needs broad (an urgent) discussion. The REST api patches are shaping up, and I'd like to focus on an important one: 14868 [1]. This bug introduces a way of specifying on the Swagger files, the required privileges to do stuff on objects. For example: + "x-koha-authorization": { + "allow-owner": true, + "allow-guarantor": true, + "permissions": { + "borrowers": "1" + } } specifies that to get a patron object you need to either have the 'borrowers' permission, be the object owner, or the guarantor of the object's owner. This is really nice, because permissions definition are now higher level entities (just a configuration thing), and they are part of the API documentation. There's even a bug with patches that introduce required permissions in the error messages. The current implementation introduces checks for each object class on the controller code. My feeling is that each business object should be responsible for such a check. The first step I made was to extend Koha::Object so it exposes an ->owner method that returns the Koha::Patron object that owns the object (because we can get the guarantees from there too). I did this to eliminate the need of class-specific checks on the controller. But at the end of the day, this still didn't feel it was good enough. I belive such a business matter should not be so tied to the controller/routing code and it is still there. Talking with Jonathan we thought we could make Koha::Objects->search accept more parameters (current userid, required permissions) and have the code checking authorization there, basically creating a filter on the search. The main problem is how to propagate the swagger-specified required permissions down to the Koha::Object in a clean way. I'd like to hear how people belive we should handle on this new+fresh code permissions check, so we have good foundations for the future of the project. Cleaning untested business logic from controller scripts is a good start! And this is the time to do it! Thanks in advance PS. I'm sure Jonathan will explain the discussion better once he comes back from the pub :-D [1] https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 -- Tomás Cohen Arazi Theke Solutions (https://theke.io <http://theke.io/>) ✆ +54 9351 3513384 GPG: B2F3C15F

3 4

biblioitems.marcxml & biblioitems.marc / HUGE performance issue !
by Paul Poulain 31 Aug '16

31 Aug '16

Hi all, Those days, we're working on a pretty large DB ( >1M biblio), for a customer that want to do many statistics on some fields. We discovered that something "simple" like: SELECT publicationyear, count(publicationyear) FROM biblioitems GROUP BY publicationyear; was giving *no result in 10mn*. This is a test DB, not optimized, but we were surprised by the results. After investigating we had the idea to create a biblioitems2 table with the same structure *EXCEPT MARCXML and MARC fields *launch the same SQL query : *result in 3seconds* !* *This could be reproduced on any query (on fields without index). I think it's because the innoDB is storing each line in one "object", so, even if you need only one column, you have to read everything. In our case, that was 12GB+ of data to read. biblioitems2 is just a few dozen MB. (all caching values are minimum and there's no index, so not involved in the results) MY CONCLUSIONS: * the biblioitems.marc field must be removed quickly: it's useless since years, and is only resulting in slowing things * the bilbioitems.marcxml field should be moved outside from this table. Something like biblio_blob, with biblionumber, biblioitemnumber and marcxml. When we need it, just join the tables. I'm almost sure it would have an important impact on Koha, as biblioitems table is called and used "everywhere". any opinion ? ** -- Paul Poulain, Associé-gérant / co-owner BibLibre, Services en logiciels libres pour les bibliothèques BibLibre, Open Source software and services for libraries

6 7

GoogleIndicTransliteration must die?
by Indranil Das Gupta 31 Aug '16

31 Aug '16

Hi all, Koha uses the deprecated (in 2011) Google Indic Transliterate v1 API to power the GoogleIndicTransliterate syspref. It seems internally the API calls to Googe Inputtools service over http! So again we are back in MIXED CONTENT mess and nothing much we can do about it, except move out of this API. transliteration.I.js:formatted:11055 Mixed Content: The page at 'https://rksmvvlibrary.in/cgi-bin/koha/opac-search.pl?q=%E0%A6%B6%E0%A7%8D%E…' was loaded over HTTPS, but requested an insecure script 'http://www.google.com/inputtools/request?text=shyama&ime=transliteration_en…'. This request has been blocked; the content must be served over HTTPS.Q.dh @ transliteration.I.js:formatted:11055Ww @ transliteration.I.js:formatted:4578Q.Ad @ transliteration.I.js:formatted:10982(anonymous function) @ transliteration.I.js:formatted:11237(anonymous function) @ transliteration.I.js:formatted:6670(anonymous function) @ transliteration.I.js:formatted:6059nq @ transliteration.I.js:formatted:2266(anonymous function) @ transliteration.I.js:formatted:6232a @ transliteration.I.js:formatted:6074 transliteration.I.js:formatted:10923 Uncaught TypeError: Cannot read property '0' of nullQ.Bh @ transliteration.I.js:formatted:10923Q.Mi @ transliteration.I.js:formatted:10862Mt.(anonymous function).j @ transliteration.I.js:formatted:8324(anonymous function) @ transliteration.I.js:formatted:3591 I saw this http://stackoverflow.com/questions/35238710/deprecated-google-api-will-not-… and this https://groups.google.com/forum/?fromgroups#!topic/google-ajax-search-api/9… Looks like its time to bid goodbye to GoogleIndicTransliteration syspref :-( -- Indranil Das Gupta L2C2 Technologies Phone : +91-98300-20971 Blog : http://blog.l2c2.co.in IRC : indradg on irc://irc.freenode.net Twitter : indradg

2 1

Interface patterns (tabs)
by David Cook 30 Aug '16

30 Aug '16

Hi Owen, Do you have any documentation for preferred us of jQuery tabs? I'm looking at https://wiki.koha-community.org/wiki/Interface_patterns but nothing is jumping out at me. David Cook Systems Librarian Prosentient Systems 72/330 Wattle St Ultimo, NSW 2007 Australia Office: 02 9212 0899 Direct: 02 8005 0595

2 2

schema.koha-community.org
by Mark Tompsett 26 Aug '16

26 Aug '16

Greetings, Currently, it lists whatever is run as of a particular date. Is there a way to version it? There are currently 181 tables, not 175. So, this is clearly the difference between master and a release. https://schema.koha-community.org/{version}/... Just inquiring and thinking out loud. GPML, Mark Tompsett

4 3

Sending Mail...
by Mark Tompsett 25 Aug '16

25 Aug '16

Greetings, Jonathan Druart wrote on the Koha list: > When you claim issues, the email is sent directly and does not pass by > the message_queue table. This sounds like an area for massive refactorization: the standardization of sending mail. Does it not? GPML, Mark Tompsett

2 1

Git server downtime for maintenance, Aug 24, 2016
by Larry Baerveldt 24 Aug '16

24 Aug '16

Greetings, The Koha Community git server (git.koha-community.org) will be down for maintenance on Wed, Aug. 24, 2016, starting on or shortly after 7 pm PDT (2 am UTC). We cannot say for certain exactly how long the site will be down, but we hope it will be less than an hour. It would probably be best to avoid committing any updates to git during that hour. - Larry -- *Larry Baerveldt* Systems Administrator ByWater Solutions Support and Consulting for Open Source Software Headquarters: Santa Barbara, CA Office: Seattle, WA Phone/Fax (888)900-8944 http://bywatersolutions.com larry(a)bywatersolutions.com What is Koha? <http://bywatersolutions.com/what-is-koha/>

1 0

Reminder: Development IRC Meeting - 24 August 2016, 7 UTC
by Katrin Fischer 23 Aug '16

23 Aug '16

Hi all, just a quick reminder about tomorrow's Development IRC Meeting. The agenda and a link to the time converter for finding out your local meeting time can as always be found on the wiki: https://wiki.koha-community.org/wiki/Development_IRC_meeting_24_August_2016 Please add any topics you want to discuss! Hope to see you there, Katrin

1 0

Move the AV code to the Koha namespace
by Jonathan Druart 23 Aug '16

23 Aug '16

Hi devs, I have already started to move the authorised values related code to the Koha namespace, but to continue I'd like to get feedback on the method to continue. I have asked you in the last "what's on in koha-devel" email, but did not get any answer. Please see bug 15799 for the step-by-step plan. Cheers, Jonathan https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15799

2 1