- Koha-devel - lists.koha-community.org

Re: [Koha-devel] [Koha-patches] Bug 14407 - Limit web-based self-checkout to specific IP addresses
by Jesse 25 Jun '15

25 Jun '15

(moving this discussion to koha-devel) Koha currently just uses regular expressions to match against IP addresses (see line 1040 or so in latest C4/Auth.pm). While this isn't terribly elegant, it's at least simple; what additional benefits does Net::IP::Match::XS bring? (It would also be a problematic dependency, given that it's not currently a Debian package.) 2015-06-24 22:59 GMT-06:00 Nicholas van Rheede van Oudtshoorn < vanoudt(a)gmail.com>: > Greetings everyone, > > As I'm still very much a perl newbie, I'd love to get some feedback on a > patch I just pushed to bug 14407 (my own bug!) We use Self-Checkout here > <http://library.pbc.wa.edu.au/>, with users just having to scan their > barcode to take books out. Our OPAC is also live over the internet. That > means that anyone who knows Koha, can access the self-checkout from off > campus! This patch adds a preference allowing one to limit access to those > pages to specific IP addresses or ranges. I've used Net::IP::Match::XS to > do the heavy lifting - is there another library that Koha already uses to > do the same sort of thing? > > Thanks in advance, > Nick > Perth Bible College <http://www.pbc.wa.edu.au/> > > > _______________________________________________ > Koha-patches mailing list > Koha-patches(a)lists.koha-community.org > http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-patches > website : http://www.koha-community.org/ > git : http://git.koha-community.org/ > bugs : http://bugs.koha-community.org/ > -- Jesse Weaver

1 0

DB: Any stored procedure to create a patron/user
by Anders Gunnare 25 Jun '15

25 Jun '15

Hello Word :) Is there any stored procedure for the Koha db MySQL that takes some parameters (input) and creates a patron/user ?! Have searched, havn't found ?! Or some guideline which tables to populate ... I assume that there must be other tables then borrowers included. Yes, I have seen the db-model, and I become afraid .... Regards Anders Gunnare IT-service Luleå tekniska universitet, 971 87 Luleå 0920 - 49 14 50 (070 306 40 37) anders.gunnare(a)ltu.se www.ltu.se

2 1

koha and mod perl
by Gaetan Boisson 25 Jun '15

25 Jun '15

Hello all, we have kept working on mod perl, and have reached a state that seems fairly stable to us for now. I know the community is working towards plack support, so this could be regarded as a temporary trick, but since most of us use Apache anyway to serve Koha, i think it's a trick worth having a look at. While we haven't managed to get plack in a state stable enough that we felt we could set it up in production for one of our libraries, we feel like we are close enough with mod perl and will likely try this very soon. So if you are feeling brave and want to give it a ride, you can head to http://intranet-demo.biblibre.com/ (login/pwd test/test, this is reset every night) and http://demo.biblibre.com/ to see how much faster it feels. We'll keep you posted once we've tried it in a real production environment ! -- Gaetan Boisson Chef de projet bibliothécaire BibLibre 06 52 42 51 29 108 avenue Breteuil 13006 Marseille gaetan.boisson(a)biblibre.com

1 0

Re: [Koha-devel] QA script - New check for spelling
by Mark Tompsett 25 Jun '15

25 Jun '15

Greetings, Christopher Nighswongerchris.nighswonger(a)gmail.com wrote: > Of course if we stick to using US English (or whatever, really) > as the default, that should really not be an issue. Agreed. > Seems like we've been down this road before. This patch makes the road more apparent. This may or may not be pleasant for some people. Languages, even dialects of English, are a politically charged mess. I won’t even go into localization issues. GPML, Mark Tompsett

1 0

RFC: Reverting MARC batches with deleted records
by Kyle Hall 23 Jun '15

23 Jun '15

The batch record tool can A) overlay/replace existing records B) revert batches, including modifications due to overlays The situation becomes messy when we begin dealing with batches having overlaid records that are now deleted. If one of these batches is reverted, the record is un-deleted and the old pre-overlay record is reinstated ( unless you have CatalogingLog on, then nothing happens do to a bug ). The question becomes, is this the correct thing to do? If a record is deleted, shouldn't it stay deleted? Please let me know what you think! Kyle http://www.kylehall.info ByWater Solutions ( http://bywatersolutions.com ) Meadville Public Library ( http://www.meadvillelibrary.org ) Crawford County Federated Library System ( http://www.ccfls.org ) Mill Run Technology Solutions ( http://millruntech.com )

3 3

Security release - Koha 3.16.12
by Mason James 23 Jun '15

23 Jun '15

The Koha release team would like to announce the release of Koha 3.16.12. This is a security release. We strongly recommend people running a 3.16 series Koha to upgrade as soon as possible. Special thanks also goes to Raschin Tavakoli and Dimitris Simos from SBA Research for finding and reporting the security bugs. Please go tohttp://koha-community.org/security-release-koha-3-16-12 <http://koha-community.org/security-release-koha-3-20-1/> to read the full release notes. Cheers, Mason.

1 0

Escaping single quotes in template variables
by David Cook 23 Jun '15

23 Jun '15

Hi all: It looks like we're not validating the data that goes into "cardnumber". This causes problems in at least one spot (in members-toolbar.inc, which is loaded by circulation.pl). If the cardnumber contains an apostrophe, you'll get an Uncaught SyntaxError in the javascript function confirm_reregistration. Unfortunately, using the "uri" filter won't fix this problem: "As of version 2.26 of the Template Toolkit, the uri and url filters use the unsafe character set defined by RFC3986. This means that certain characters ("(", ")", "~", "*", "!" and the single quote "'") are now deemed unsafe and will be escaped as hex character sequences. The double quote character ('"') is now deemed safe and will not be escaped" (http://template-toolkit.org/docs/manual/Filters.html#section_uri) The required version in Koha is 2.22 and the version in Debian appears to be 2.24. I'm currently using 2.25. So I'm not really sure where to go from here but here are some ideas: 1) Upgrade Template Toolkit to 2.26 (possibly not so easy from a Debian perspective [Robin might want to chime in on that one], and who knows what else has been changed between 2.24 and 2.26? The readme on Github isn't super comprehensive https://github.com/abw/Template2) 2) Replace the single quote in the template with an encoded single quote (not very elegant and possibly a bit annoying to maintain) 3) URI encode the data in the .pm or .pl (I rather not handle display template logic in the actual Perl. Plus, cardnumber is passed opaquely to the template via "$template->param(%$borrower);" at the moment) 4) Limit the data allowed as a cardnumber (this is probably the hardest thing to do because a borrower can be created in a few different ways. which might make reporting data validation errors more or less difficult.) 5) We could write our own Template Toolkit Filter class that escapes the most comprehensively What does the Koha brain trust think? David Cook Systems Librarian Prosentient Systems 72/330 Wattle St, Ultimo, NSW 2007

2 1

Security release - Koha 3.18.8
by Liz Rea 23 Jun '15

23 Jun '15

The Koha release team would like to announce the release of Koha 3.18.8 this is a security and a bugfix release. Of special note in this release is that 3.18 is now compatible with Debian Jessie. Go forth and upgrade your Squeeze boxes, ye users of 3.18! As such we strongly recommend people running 3.18 should upgrade as soon as possible Special thanks also goes to Raschin Tavakoli and Dimitris Simos from SBA Research for finding and reporting the security bugs. Please go to http://koha-community.org/security-release-koha-3-18-8/ <http://koha-community.org/security-release-koha-3-20-1/> to read the full release notes. Cheers, Liz Rea

1 0

Security release - Koha 3.20.1
by Chris Cormack 23 Jun '15

23 Jun '15

The Koha release team would like to announce the release of Koha 3.20.1, this is a security and a bugfix release. As such we strongly recommend people running 3.20.0 should upgrade as soon as possible Special thanks also goes to Raschin Tavakoli and Dimitris Simos from SBA Research for finding and reporting the security bugs. Please go to http://koha-community.org/security-release-koha-3-20-1/ to read the full release notes Chris

1 0

Koha 3.20.1 slight delay
by Chris Cormack 22 Jun '15

22 Jun '15

As you, we do time based releases so 3.20.1 is due now. However there are a couple of important patches waiting qa that I want to push before the release. So I'm hoping they will get sorted very shortly and I will release as soon as they are. Chris

2 1