- Koha-devel - lists.koha-community.org

Simple bug to test: News by branch
by Mark Tompsett 16 Feb '14

16 Feb '14

Greetings, Okay, it’s a couple months sitting there, and I figure it’s the enhancement status is part of the reason people haven’t gotten to looking at it. The other part being just that everyone is very busy. Bug 7567 has 8 patches which are actually fixes, for the most part (adding testing vs. really insufficient test, updating licenses, cleaning up the sample news data, cleaning up a warning, correcting an incorrect dropdown behaviour, removing finish() calls, fixing the crazy long number of parameters into a hashref), and only the last 2 are the actual enhancements (adding branchcode into the opac_news table, and then actually using it). I intentionally split it into small easily testable pieces. It would nice to see it signed off. Thanks in advance. GPML, Mark Tompsett

1 0

Re: [Koha-devel] [Koha] Kohacon 2014 in Córdoba, Argentina
by Paul Poulain 16 Feb '14

16 Feb '14

Le 09/10/2013 22:35, Luis Maguina a écrit : > Cordoba is in South - America ... Argentina :) In french, we say "lapsus révélateur". Google translate this to "revealing slip" ;-) -- Paul POULAIN - Associé-gérant Tel : (33) 4 91 81 35 08 http://www.biblibre.com Logiciels Libres pour les bibliothèques et les centres de documentation

2 1

Call for news for February newsletter
by Koha Newsletter 14 Feb '14

14 Feb '14

Fellow Koha users ~ We're collecting news for the February newsletter. Send anything noteworthy to: k o h a news AT gmail dot com News criteria: --------------------------- * News items can be of any length. We can link to longer entries. * Anything and everything Koha. * Submit by the 26th. Thank you! -- Chad Roseburg Joanne Dillon Editors, Koha Newsletter

1 0

wiki page about the creation of a new authority type
by Fabio T. 12 Feb '14

12 Feb '14

Hi everyone, some weeks ago I thought of a page in the Koha wiki dedicated to the creation of new autority types. I also sent a mail to the list but I realized just today that the address I wrote from wasn't registered to Koha-devel (the list was forwarded from another address of mine)... The idea came up mainly for two reasons. First, to shed some light on the procedure (I'm not even 100% sure to know all the pieces involved!); second, the manual lacks this kind of information (it just says to create a new framework as for the biblio ones, omitting any edit on the Zebra side for example). This way the community would benefit from having a standard and approved procedure for creating a fully working new authority type; the wiki format would ease the review and update of the information... then maybe some of the contents could make it to the manual (those not directly targeted to system administrators I guess). So, here's the page: http://wiki.koha-community.org/wiki/Create_new_authority_type I'm not sure it is entirely complete and correct, so any review could be crucial for the users (should I add a note on top of the page stating it is still a work-in-progress yet to be verified from the developer community?). Thank you in advance for any thoughts or contributions. Regards, Fabio -- View this message in context: http://koha.1045719.n5.nabble.com/wiki-page-about-the-creation-of-a-new-aut… Sent from the Koha-devel mailing list archive at Nabble.com.

1 0

FYI: CVE numbers for recent security update
by Galen Charlton 10 Feb '14

10 Feb '14

Hi, I requested CVE numbers for the issues fixed in the security releases; here's what was assigned: CVE-2014-1922: absolute path traversal issue in tools/pdfViewer.pl CVE-2014-1923: directory traversal issues in edithelp.pl and member-picupload.pl CVE-2014-1924: MARC framework import/export did not require authentication CVE-2014-1925: MARC framework import/export could be used to perform unexpected SQL commands Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc(a)esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org

1 0

Wiki page update question
by Mark Tompsett 10 Feb '14

10 Feb '14

Greetings, http://wiki.koha-community.org/wiki/Developer_handbook Handy little page, but as I have noted on the discussion, the QA Testing Tools are missing from the list. Who? Where? How? Et cetera, et cetera – do I get the QA Testing Tools onto the page? That little macro-y {DevBook} is too magical for a wiki newbie like myself. GPML, Mark Tompsett

3 2

ElasticSearch for Koha - presenting the Koha Gruppo Italiano's project
by Stefano Bargioni 08 Feb '14

08 Feb '14

The Koha Gruppo Italiano is proud to present a new project for the development of Koha. Recently the community has shown a big interest in substituting Zebra with a new search engine. How this is done -- whether Zebra is replaced or complemented, etc. -- will determine the workload and necessary financial support. The Koha Gruppo Italiano wants to promote the project through a crowd-funding campaign, sponsorships, events, endorsements etc. The Koha Gruppo Italiano would like to bring together the community of developers to determine the possibility of introducing the new search engine, to set up the work flow, and to collect the funding necessary for the project. On March 11, 2014 the project will be presented in Marseille at the Koha Hackfest for evaluation. Important software editors/producers working for Koha, and others interested in the project will be invited. The project will be presented by Stefano Bargioni, Deputy Director and System Librarian at the Library of the Pontificia Università della Santa Croce. The goal is to discuss solutions, and propose ideas in order to take initial decisions. The project and its progress can be followed through the website <http://kohagruppoitaliano.moonfruit.com>, on FB <http://www.facebook.com/KohaGruppoItaliano> and on Twitter <https://twitter.com/kohagruppoit>. We are very interested to hearing your first impressions, your suggestions etc. about this proposed project. Please respond to this e-mail if you have any comments. Probably the best contributions during this early phase will be the definition of the fundamentals. Example: - Which search engine? - ElasticSearch, Solr or other (even if, at this time, the name of the initial project is ElasticSearch for Koha)? - Should the effort focus on complementing Zebra or on its replacement? - Subdivide the workload. - Draft a road map. We are grateful to all developers who will be contributing to our project. We hope that this project is seen favorably within the community, and specifically wish that the Librarian community worldwide see the benefits of this project and would be willing to assist us with finding financial support. Kindest regards, Franziska Wallner, Stefano Bargioni, Sebastian Hierl, Juan Diego Ramirez

6 8

IMPORTANT: Koha security release
by Galen Charlton 07 Feb '14

07 Feb '14

[apologies for the multi-post, but if there are any folks who are subscribed to koha-devel but not the general list, they need to see this too] The Koha community is releasing a security update for all supported and recent unsupported versions of Koha. The security update is available in the following new releases being made today: * 3.14.3 * 3.12.10 * 3.10.13 * 3.8.23 The following security bugs are fixed by this update: * Bug 11660: tools/pdfViewer.pl could be used to read arbitrary files on the server * Bug 11661: the staff interface help editor could be used to modify or create arbitrary files on the server with the privileges of the Apache user * Bug 11662: member-picupload.pl could be used to write to arbitrary files on the server with the privileges of the Apache user * Bug 11666: the MARC framework import/export function did not require authentication, and could be used to perform unexpected SQL commands The fix for bug 11666 removes SQL as a supported format for importing or exporting MARC frameworks. We recommend that you upgrade immediately to get the fixes for these security issues. However, if you are not able to perform the upgrade right away, you can mitigate against the issues by performing the following actions: * deleting the pdfViewer.pl script * deleting the member-picupload.pl script * making edithelp.pl not be executable, e.g., by doing chmod a-x edithelp.pl * making import_export_framework.pl not be executable, which will disable the MARC framework import and export functionality Our thanks to John Lightsey for finding and reporting the issues. The 3.14.3 and 3.10.13 releases also contain unrelated bugfixes which are described in their release notes. Please note that if you installed from a tarball, you may need to manually delete pdfViewer.pl and member-picupload.pl, even after you upgrade. Users of the Debian packages for 3.12.x and 3.14.x (and master) can get the latest release by running apt-get update followed by apt-get upgrade. Tarballs are also available and can be downloaded from http://download.koha-community.org. If you are not running a version of Koha that has has a release maintainer (currently 3.8.x, 3.10.x, 3.12.x, and 3.14.x), we strongly urge you to upgrade to a supported version. Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc(a)esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org

2 1

Reporting security bugs
by Galen Charlton 04 Feb '14

04 Feb '14

Hi, There is now a mechanism in place for reporting security bugs via Bugzilla. If you look at the footer, you should now see a 'Report security bug' link. This allows someone who has a Bugzilla account to enter a bug in a new BZ product called 'Koha security'. Bugs reported in this fashion are visible only to the reporter and to members of a Koha security group currently consisting of the following individuals: Bernardo Gonzalez Kriegel Chris Cormack Frère Sébastien Marie Fridolin SOMERS Galen Charlton Ian Walls Jared Camins-Esakov Jonathan Druart Katrin Fischer Kyle M Hall M. de Rooy MJ Ray (software.coop) Paul Poulain Robin Sheat Tomás Cohen Arazi The idea is that members of the security group would be responsible for evaluating the bugs, fixing them (and drawing in outside help if needed), and releasing the fixes. Once a fix is released, the relevant bug(s) would be sanitized to remove mention of direct exploits, then have their products changed to 'Koha' so that they would be visible to all. This is not set in stone, so I invite discussion of the security policy. I also invite anybody who may have been sitting on security bugs for lack of a means to report them securely to go ahead and use BZ. Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc(a)esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org

3 3

Some thoughts on the SIP-server scalability
by Petter Goksøyr Åsen 03 Feb '14

03 Feb '14

Dear Koha devs! I work at at Oslo public library. We recently decided to go for Koha, and are now working on planning the migration from our current ILS. Our library is fully automated, with RFID-checkin machines taking care of almost all of our circulation. We currently have around 50 of these running at 15 branches around the city. Because of this, we naturally need the SIP-server to handle quite a load. I checked the logs of our current ILS, and found the number of SIP-messages peeked at 58 per second. (In addition to the checkin-machines - we have a lot of RFID-workstations which potentially also will make use of SIP) Correct me if I'm wrong, but this is what I have found out: Koha's SIP server can only handle one request at a time. So if you need more you have to spin up more SIP-severes. This fine for a few, but try to spin up 30 of theese - it takes 15 minutes just to get them all started on a new box with plenty of RAM & CPU. The servers are independent processes which share no resources.. Instead of forking seperate processes for each connection - what about a server which runs as _one_ process and handles multiple tcp connections? I've read about and tested Poe (http://poe.perl.org/) with this in mind - and it seems pretty nice. Poe is an evented framework (akin to Node for javascript or EventMachine in Ruby) which handles such multiplexing of severeal connections. Poe seems very mature, but I'm not competent to judge if its a good fit. There are other options as well (ex IO::Async & AnyEvent ) Any thoughts? We're also very keen on hearing about experiences from other automated Koha libraries, especially those with more than a checkin-machines. Best regards, Petter Goksøyr Åsen Deichmanske bibliotek / Oslo Public Library

4 7