- Koha-devel - lists.koha-community.org

Koha Database Structure Meeting
by Joshua M. Ferraro 12 Sep '07

12 Sep '07

Hi all, Paul and I have done some cleaning of the kohastructure.sql file for the 3.0 release lately (see the following commitdiffs: http://git.koha.org/cgi-bin/gitweb.cgi?p=Koha;a=commitdiff;h=d60d540d6db582… http://git.koha.org/cgi-bin/gitweb.cgi?p=Koha;a=commitdiff;h=b40c26cffedf10… ). There are still a few remaining issues to clear up so we've decided to hold a meeting strictly about the Koha SQL definition for 3.0. The meeting's open to anyone interested in database design, feel free to join us on August 31st at 16:00 GMT. Here's the time in your area: http://tinyurl.com/2bteuw We'll be meeting on IRC at irc.katipo.co.nz on channel #koha, though you can also reach us via the freenode relay on #koha at freenode. I've put up a meeting agenda, please feel free to add to it: http://wiki.koha.org/doku.php?id=meetingnotes07aug31 Cheers, -- Joshua Ferraro SUPPORT FOR OPEN-SOURCE SOFTWARE President, Technology migration, training, maintenance, support LibLime Featuring Koha Open-Source ILS jmf(a)liblime.com |Full Demos at http://liblime.com/koha |1(888)KohaILS

3 4

vmware image of the 2.2.9 version of Koha
by Deb Bergeron 12 Sep '07

12 Sep '07

Hi, Is anyone aware of a vmware image of the 2.2.9 version of Koha? Thanks, Deb -------------------------------------------------------------------------- Deb Bergeron <mailto:bergeron@macalester.edu> CLIC <http://clic.edu>, System Administrator User Support 1619 Dayton Ave. Suite 204A, Saint Paul, MN 55104 T: 651.644.3878 C:651-487-7609 F:651.644.6258 bergeron(a)macalester.edu <mailto:bergeron@macalester.edu> http://clic.edu

2 1

Interface Design Patterns
by Joshua M. Ferraro 06 Sep '07

06 Sep '07

Hi all, Owen Leonard and I have been working on improvements to the organization, markup, and style of the Koha 3.0 templates. I just want to summarize our progress thusfar. 1. We've been primarily working on the Staff client as the OPAC had a fairly massive overhaul recently and we're pretty confident we've solved most of the design problems there and can easily apply those styles to the 3.0 OPAC at any time. 2. we moved all the non-.inc files out of the includes/ directory, and moved all the .tmpl files into a modules/ directory. We also created a lib/ for external libraries such as YUI, Jquery, the calendar library. CSS and JavaScript are now contained in the css/ and js/ dirs respectively. 3. We've started working on a 'style guide' for Koha templates that is a collection of recommended conventions, background on organization of the templates, and a discussion of 'patterns', 'idioms', and other UI terminology and concepts: http://wiki.koha.org/doku.php?id=en:documentation:templates_style_guide 4. Started organizing the Koha pages into categories based on the 'pattern' of the page. For instance, there are two pages with a type of 'login' (the installer login page and the main auth.tmpl). Many many pages in Koha fall into the pattern of 'form + filter', and we've laid out the common elements and will be defining conventions for how the markup and style will work for the default 3.0 templates. More patterns will follow as we identify and define conventions for them. 5. We're validating pages as we go, with the goal of having all pages completely valid in 3.0 as they are in 2.2. That's about all I can think of at the moment ... we're meeting again tomorrow to continue along this track, and I'll report back here as we make progress. Cheers, -- Joshua Ferraro SUPPORT FOR OPEN-SOURCE SOFTWARE President, Technology migration, training, maintenance, support LibLime Featuring Koha Open-Source ILS jmf(a)liblime.com |Full Demos at http://liblime.com/koha |1(888)KohaILS

1 0

database analysis (diff between 22+updatedatabase and kohastructure.sql)
by Paul POULAIN 04 Sep '07

04 Sep '07

I have reviewed all the diffs between my ipt3 database, that is a koha 2.2 + updatedatabase and the head (3.0) kohastructure.sql There are lots of varchar/char differences =============================================== http://dev.mysql.com/doc/refman/5.0/en/silent-column-changes.html says : Before MySQL 5.0.3, VARCHAR columns with a length less than four are changed to CHAR. OK, my database was on mySQL 4.1 previously, thus the differences. I discard them, it's meaningless anyway There are a lot of NOT NULL default '' vs NOT NULL ================================================== (or NOT NULL default 0 vs NOT NULL) http://dev.mysql.com/doc/refman/5.0/en/data-type-defaults.html says : If the column cannot take NULL as the value, MySQL defines the column with an explicit DEFAULT clause, using the implicit default value for the column data type. Implicit defaults are defined as follows: For numeric types, the default is 0, with the exception that for integer types declared with the AUTO_INCREMENT attribute, the default is the next value in the sequence. For date and time types other than TIMESTAMP, the default is the appropriate “zero” value for the type. For the first TIMESTAMP column in a table, the default value is the current date and time. See Section 10.3, “Date and Time Types”. For string types other than ENUM, the default value is the empty string. For ENUM, the default is the first enumeration value. So the differences as meaningless, I discard them as well. (hereafter, when I write x VS Y, I mean kohastructure.sql VS mydatabase) action_logs : text vs mediumtext : ================================== just differ on the length the record can contain, but even text is enough (http://dev.mysql.com/doc/refman/5.0/en/storage-requirements.html) biblioitems ============ - volumedesc is text VS char(255). Harmless, text is better (although more space consuming) - some columns (the new ones) are not at the same place in the table. harmless - marc longblob vs blob : marc column is deprecated & could be dropped soon if I don't mind. howeber, longblob is better browser ======== don't exist VS exist : this table is speficically created & filled by a specific script, I'll explain on request what it is for categorytable ============== text VS mediumtext : harmless, anyway, text is too large imho charges ======== don't exist VS exist : kohastructure is right. we can drop it. deletedbiblioitems ==================== dewey 8,6 VS char(30) : kohastructure must be modified to char(30), as in biblioitems. deleteditems ================ barcode char(9) VS char(30) : kohastructure must be modified to char(30), char(9) is too small for some libraries items ================= homebranch : char(4) VS char(10) : this one is a major diff, that can cause bugs. ***MUST*** be changed in kohastructure, or contraints will fail. itemsprices ============= don't exist VS exist : kohastructure is right. we can drop it. labels ============== - batch_id exist VS don't exist : kohastructure probably right. - ENGINE=myISAM VS ENGINE=InnoDB : MUST be changed in kohastructure labels_conf : =============== - lot of differences : my structure has to be updated (however, ipt don't use label facilities, so they don't care ;-) ) - ENGINE=myISAM VS ENGINE=InnoDB : MUST be changed in kohastructure labels_templates : =================== table has to be added on my side letters & many other tables ========== mediumtext VS text : harmless, both are acceptable. mediumtext maybe a little bit better although marc_biblio ============ can be dropped on my side, I agree mediatypetable : ================= exist VS don't exist : i'm right imho, kohastructure should drop this table sessionqueries =============== don't exist VS exist : kohastructure is right. we can drop it. subcategorytable ================= exist VS don't exist : i'm right imho, kohastructure should drop this table subscription ============== firstacquidate : NULL default NULL vs NOT NULL. hdl will confirm, but I think NOT NULL is better here subscriptionhistory ============== histstartdate : NULL default NULL vs NOT NULL. hdl will confirm, but I think NOT NULL is better here users/websites / z3950queue/ z3950queries =============== don't exist VS exist : kohastructure is right. we can drop them Foreign keys ============== on my side most constraints are repeated, I don't know why, but it's stupid As a conclusion : I should do that test again on another 22+updatedatabase config, to be sure, but it seems there are no so many diffs between kohastructure.sql & 22+updatedatabase. I'll let you know ASAP -- Paul POULAIN et Henri Damien LAURENT Consultants indépendants en logiciels libres et bibliothéconomie (http://www.koha-fr.org) Tel : 04 91 31 45 19

1 0

Testing Koha 3
by Bradley Duane Peters 03 Sep '07

03 Sep '07

Hello, I'm aware that Koha 3 is not yet even in beta, but I'd be interested to know whether its at the point were it can be run. I have also looked at the Roadmap on the wiki but at this point I'm not familiar enough with the codebase to interpret that properly. I did the basic checkout from the public Git repository and have been looking at that. It's very possible I've missed it because I'm not very familiar with Koha but I can't find any of the zebra database stuff. In short, is it possible to setup an instance of Koha using the code from the repository? And, if so is there somewhere in particular I should be looking for help? Thanks, Bradley Peters.

3 3

Re: XSS Vulnerabilities in Koha
by Rick Welykochy 31 Aug '07

31 Aug '07

[moved to Koha-devel] ... Chris Cormack wrote: > We did fix this up a while back for the opac, but overtime > vulnerabilities might have crept back in. I'm not too worried about the > intranet side, if someone malicious has access to that, you have bigger > problems than xss :-) But Id certainly like to see patches for the opac. Correct me if I am wrong, but XSS does not require the attacker to have access to your server. Just the ability to carefully construct a URL to that server that allows an attack via a (naive) user on the server, the Intranet in this case. If one is already logged into the Intranet and then is somehow tricked into clicking on a malicious (XSS) link found elsewhere, in an email or on another site, bingo! Gotcha! I certainly do not profess to be an expert in XSS, but I'd imagine that if one was determined enough to get access to the Koha Intranet of a particular library for some nefarious purpose, a cookie theft might be possible. It would be educational to see an XSS in action on Koha, a real world example. Then more eyes could have a look and help with an XSS audit. My brief read on the web about XSS indicates that there are many many varieties of the exploit, so that one would have to keep in mind these many attack vectors while reviewing the sourcecode. And it would seem that many attacks originate in user-supplied form data, so that proper escaping and entity replacement of significant delimiters like < and > are paramount as a first level of defense. Which brings to mind another audit: one for SQL injection attacks. I haven't had a close at the code, but a grep of "->quote(" turns up 102 uses in Koha/2.2.9, which leaves one feeling somewhat confident that the problem has been addressed at one stage. cheers rickw -- _________________________________ Rick Welykochy || Praxis Services I didn't have time to write a short letter, so I wrote a long one instead. -- Mark Twain

3 4

[Fwd: Re: [Koha-devel] how to contribute to Koha]
by Paul POULAIN 31 Aug '07

31 Aug '07

-- Paul POULAIN et Henri Damien LAURENT Consultants indépendants en logiciels libres et bibliothéconomie (http://www.koha-fr.org) Tel : 04 91 31 45 19

1 0

how to contribute to Koha
by samuel desseaux 31 Aug '07

31 Aug '07

Hello! I'm newbie on this list and i would like to contribute to the development of Koha. My name is Samuel (you can say "sam",if you want). I'm 32 years old and i live in North of France. I work in a library and i am in charge of everything concerning computers,IT. At work, i use Horizon of Dynix but i hope that one day, i could use a free software like Koha. So, i'd like to know how i could contrubute. I can coding, debugging,translating,writing documentations ( i don't know in which field there's a lack of contributors). Bye sam

2 1

IMPORTANT Koha 3.0 updatedatase and kohastructure.sql
by Joshua M. Ferraro 31 Aug '07

31 Aug '07

Hi all, For years, we've had trouble maintaining the official Koha SQL definition, it seems like every developer probably has a slightly different definition. This is fine, however, we need to decide on an appropriate process for updating the official kohastructure.sql file that forms the basis for the new Web Installer in Koha 3.0. If you look back through the history of this file: http://cvs.savannah.nongnu.org/viewvc/koha/installer/kohastructure.sql?root… You'll notice vastly different versions ... people seem to just overwrite it with a new def exported in their favorite tool (mysqldump, phpmyadmin, etc.). Recently I had to revert kohastructure.sql in CVS because it patently failed for me ... I noticed that there are some definitions missing as well, and discrepancies between versions w/respect to the constraints. For instance, I asked Paul this afternoon to send me his 3.0 SQL definition, but that didn't include the 'defaultvalue' column in the marc_subfield_structure table, and, as a result, the MARC editor is broken for new installations when using that definition. I'd also like to point out that updatedatabase should start completely blank for 3.0. IMO updatedatabase shouldn't be the upgrade path from 1.x or 2.x to 3.0 ... rather, it should be the upgrade path for 3.0 to 3.2, etc. Other thoughts? I'd like to get feedback from everyone on the best way to maintain kohastructure.sql and updatedatabase, to make sure we always have a known SQL definition and update process. Comments, ideas? Cheers, -- Joshua Ferraro SUPPORT FOR OPEN-SOURCE SOFTWARE President, Technology migration, training, maintenance, support LibLime Featuring Koha Open-Source ILS jmf(a)liblime.com |Full Demos at http://liblime.com/koha |1(888)KohaILS

5 5

dummy function for gettext?
by Owen Leonard 31 Aug '07

31 Aug '07

I'm curious about something in the 3.0 templates: <script language="JavaScript" type="text/javascript"> function _(s) { return s } // dummy function for gettext </script> Can anyone tell me what purpose that serves? Thanks, Owen -- Web Developer Nelsonville Public Library http://www.myacpl.org

2 1