April 2025 - Koha - lists.katipo.co.nz

Koha Community Newsletter: April 2025
by Michael Kuhn 29 Apr '25

29 Apr '25

The Koha Community Newsletter for April 2025 is here: https://koha-community.org/koha-community-newsletter-april-2025/ Many thanks to everyone who submitted articles and news to this newsletter! Please feel free to e-mail me (mik(a)adminkuhn.ch) with any corrections or suggestions. Michael Kuhn Editor, Koha Community Newsletter -- Geschäftsführer · Diplombibliothekar BBS, Informatiker eidg. Fachausweis Admin Kuhn GmbH · Pappelstrasse 20 · 4123 Allschwil · Schweiz T 0041 (0)61 261 55 61 · E mik(a)adminkuhn.ch · W www.adminkuhn.ch

1 0

Re: [Koha] Koha Digest, Vol 234, Issue 17
by David Cook 29 Apr '25

29 Apr '25

Hi Justin, Always good to see another Australian using Koha! I think you're right. I don't think this is relevant for RabbitMQ. That said, it looks like Ubuntu pushed out a security release for RabbitMQ on 27 March 2025 for a different CVE. If you're using Debian/Ubuntu and have unattended upgrades on or frequently update your server, then you'll generally be fine. David Cook Senior Software Engineer Prosentient Systems Suite 7.03 6a Glen St Milsons Point NSW 2061 Australia Office: 02 9212 0899 -----Original Message----- Message: 1 Date: Mon, 28 Apr 2025 11:11:30 +1000 From: Justin Dowswell <justin.dowswell(a)tenantsunion.org.au> To: koha(a)lists.katipo.co.nz Subject: [Koha] Erlang/OTP SSH (CVE-2025-32433) - is rabbitmq-server affected? Message-ID: <CAGzh+UNnq-_Bs3r=5F=HjbcjtATTY2=+rcFywMxU9zhau-6J1Q(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hey everyone, Been flagged by my VPS provider that our Koha instance may be affected by this vulnerability. It seems rabbitmq-server has some OTP dependencies, though not the erlang-ssh package. Here is the official advisory: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 On my koha instance these erlang packages are installed: erlang-asn1 erlang-base erlang-crypto erlang-eldap erlang-ftp erlang-inets erlang-mnesia erlang-os-mon erlang-parsetools erlang-public-key erlang-runtime-tools erlang-snmp erlang-ssl erlang-syntax-tools erlang-tftp erlang-tools erlang-xmerl So to me it looks like this flag is a false positive, but thought best to reach out here. Thanks in advance, Justin Dowswell (he/him) Technology Coordinator Tenants' Union of NSW 02 8117 3721

1 0

koha-US May 2025 Events & Meetings
by Kristi Krueger 28 Apr '25

28 Apr '25

Hello! koha-US online meetings and events are free and open to all. See our calendar for a full list: http://koha-us.org/calendar/. For Google Calendar users, add our events calendar to your list for easy access to meeting times and links: https://calendar.google.com/calendar/u/1?cid=a29oYS11cy5vcmdfZG1xb2pkczE5Zn… *Meetings* General Meeting - Wednesday, May 07 @ 8:30a PT / 11:30a ET / 15:30 UTC Board Meeting - Wednesday, May 14 @ 8:30a PT / 11:30a ET / 15:30 UTC *Special Interest Groups* Cataloging - Thursday, May 01 @ 8:00a PT / 11:00a ET / 15:00 UTC Baby Devs - Thursday, May 08 @ 10:00a PT / 1:00p ET / 17:00 UTC System Administration - Tuesday, May 13 @ 8:00a PT / 11:00a ET / 15:00 UTC Web Development - Thursday, May 15 @ 10:00a PT / 1:00p ET / 17:00 UTC Acquisitions - Tuesday, May 20 @ 9:00a PT / 12:00p ET / 16:00 UTC Consortia - Thursday, May 22 @ 9:00a PT / 12:00p ET / 16:00 UTC Circulation - Wednesday, May 28 @ 10:30 PT / 1:30 ET / 17:30 UTC Visit http://koha-us.org/special-interest-groups/ to learn more and sign up for topic-specific mailing lists. Most meetings and events are recorded and made available at https://www.youtube.com/kohaus Kristi Krueger koha-US Secretary secretary(a)koha-US.org

1 0

Koha April release with security fixes
by Paul Derscheid 28 Apr '25

28 Apr '25

Hi all, The Koha community is proud to announce the release of April versions: 24.11.04 24.05.09 23.11.14 22.11.26 It is a bugfix/maintenance release including some security fixes. It is highly recommended to upgrade. The full release notes are available at: https://koha-community.org/koha-24-11-04-released/ https://koha-community.org/koha-24-05-09-released/ https://koha-community.org/koha-23-11-14-released/ https://koha-community.org/koha-22-11-26-released/ Debian packages are available. Tarballs will follow soon. Note: This time we were a bit behind due to numerous holidays during the last week. Kind regards Paul -- LMSCloud GmbH Paul Derscheid - Software Engineer Bismarckstr. 3 - D-72764 Reutlingen e paul.derscheid(a)lmscloud.de w www.lmscloud.de

1 0

Erlang/OTP SSH (CVE-2025-32433) - is rabbitmq-server affected?
by Justin Dowswell 28 Apr '25

28 Apr '25

Hey everyone, Been flagged by my VPS provider that our Koha instance may be affected by this vulnerability. It seems rabbitmq-server has some OTP dependencies, though not the erlang-ssh package. Here is the official advisory: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 On my koha instance these erlang packages are installed: erlang-asn1 erlang-base erlang-crypto erlang-eldap erlang-ftp erlang-inets erlang-mnesia erlang-os-mon erlang-parsetools erlang-public-key erlang-runtime-tools erlang-snmp erlang-ssl erlang-syntax-tools erlang-tftp erlang-tools erlang-xmerl So to me it looks like this flag is a false positive, but thought best to reach out here. Thanks in advance, Justin Dowswell (he/him) Technology Coordinator Tenants' Union of NSW 02 8117 3721 -- *The Tenants’ Union of NSW recognises that Aboriginal and Torres Strait Islander peoples are the First Peoples of Australia. Our office is on the lands of the Gadigal of the Eora Nation. We are committed to respecting Aboriginal and Torres Strait Islander peoples, cultures, lands, and histories as we battle for tenants’ rights in NSW. Read our full Acknowledgement of Country <https://www.tenants.org.au/tu/acknowledgement-country>* *.* <https://www.tenants.org.au/> <https://rentingfair.org.au/> <https://www.facebook.com/TUNSW/> <https://twitter.com/TUNSW> <https://www.youtube.com/channel/UCEkW8D86OVVAV0QedKFhl9w> tenants.org.au <https://www.tenants.org.au/> This email transmission is intended only for the addressee and may contain confidential or privileged information. Confidentiality and privilege are not waived if you are not the intended recipient of the email, nor may you use, review, disclose, disseminate or copy any information contained or attached to it. If you received this email in error please delete it and any attachments and notify us immediately by return email. Tenants' Union of NSW can only provide information and advice in the New South Wales and Commonwealth jurisdictions. If you are enquiring from another state or territory please contact your local community legal centre.

1 0

Re: [Koha] Koha as ID provider to EduGain or EduGate
by David Cook 28 Apr '25

28 Apr '25

Hi Niamh, Out of the box, Koha itself cannot act as an Identity Provider. However, I have created a solution that I use for a few libraries. Firstly, I use the open source identity and access management solution Keycloak to act as the Identity Provider for the target third-party service using either OpenID Connect or SAML. Secondly, I use this Keycloak plugin that I wrote (https://gitlab.com/minusdavid/keycloak-user-storage-koha) to connect Keycloak's backend system to Koha, so that the username and password you put into the Keycloak UI is actually processed by Koha. Other people might have some other ideas, but to summarize again: Koha doesn't have this capability, but there are workarounds like the one I mention above, which can work. Fair warning: the Keycloak plugin uses an API which the Keycloak community is planning to replace at some stage, so eventually I'll probably need to update the plugin. That said, they've already done that once before, and I've already updated it once before haha. Anyway, I hope that's helpful. David Cook Senior Software Engineer Prosentient Systems Suite 7.03 6a Glen St Milsons Point NSW 2061 Australia Office: 02 9212 0899 -----Original Message----- Date: Thu, 24 Apr 2025 12:55:06 +0000 From: Niamh Walker-Headon <Niamh.WalkerHeadon(a)hse.ie> To: "koha(a)lists.katipo.co.nz" <koha(a)lists.katipo.co.nz> Subject: [Koha] Koha as ID provider to EduGain or EduGate Message-ID: <VI1PR05MB623825AA745B82093EA6A35FE4852(a)VI1PR05MB6238.eurprd05.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" Good afternoon, I am hoping that someone on the list can assist. We are trying to find examples of where Koha is used as the identity provider for authentication to either edugate or edugain. If your Koha instance does this, could you please let me know? With many thanks, Is mise le meas, Niamh Walker-Headon Bainisteoir Acmhainní Leabharlainne | Library Resources Manager MLIS ALAI Leabharlann FSS, Leabharlann Osipidéal Steevens, Seomra 247, Ospidéal an Dr. Steevens, Lána Steevens, Baile Átha Cliath 8 D08 W2A8 HSE Library, Dr. Steevens' Library, Room 247, Ground Floor, Dr. Steevens' Hospital, Steevens' Lane, Dublin 8 D08 W2A8 Tel: 0818-100-900<tel:0818100900> DD: +353 (087) 4354211 087 6354211 | niamh.walkerheadon(a)hse.ie<mailto:niamh.walkerheadon@hse.ie> | https://www.hselibrary.ie<https://www.hselibrary.ie/>|@hselibrary @AnLeabharlannai

1 0

The Terrific Every-Other-Thursday Training Video | 516
by BRANNON, CHRISTOPHER 24 Apr '25

24 Apr '25

We explored the Item Group feature last year in episode 426. Today we take a deeper look at what the feature can and can't do. We'll show you some easy jQuery adjustments to streamline its use for both patrons and staff. https://youtu.be/ymyqQmQcv3U Respectfully, Christopher Brannon koha-US Admin

1 0

Koha as ID provider to EduGain or EduGate
by Niamh Walker-Headon 24 Apr '25

24 Apr '25

Good afternoon, I am hoping that someone on the list can assist. We are trying to find examples of where Koha is used as the identity provider for authentication to either edugate or edugain. If your Koha instance does this, could you please let me know? With many thanks, Is mise le meas, Niamh Walker-Headon Bainisteoir Acmhainní Leabharlainne | Library Resources Manager MLIS ALAI Leabharlann FSS, Leabharlann Osipidéal Steevens, Seomra 247, Ospidéal an Dr. Steevens, Lána Steevens, Baile Átha Cliath 8 D08 W2A8 HSE Library, Dr. Steevens' Library, Room 247, Ground Floor, Dr. Steevens' Hospital, Steevens' Lane, Dublin 8 D08 W2A8 Tel: 0818-100-900<tel:0818100900> DD: +353 (087) 4354211 087 6354211 | niamh.walkerheadon(a)hse.ie<mailto:niamh.walkerheadon@hse.ie> | https://www.hselibrary.ie<https://www.hselibrary.ie/>|@hselibrary @AnLeabharlannai ________________________________ "Tá an fhaisnéis sa ríomhphost seo (ceangaltáin san áireamh) faoi rún. Baineann sé leis an té ar seoladh chuige amháin agus tá sé ar intinn go bhfaighfidh siadsan amháin é agus gurb iadsan amháin a dhéanfaidh breithniú air. Más rud é nach tusa an duine ar leis é, tá cosc iomlán ar aon fhaisnéis atá ann, a úsáid, a chraobhscaoileadh, a scaipeadh, a nochtadh, a fhoilsiú, ná a chóipeáil . Seains gurb iad tuairimí pearsanta an údar atá san ríomhphost agus nach tuairimí FSS iad. Má fuair tú an ríomhphost seo trí dhearmad, bheadh muid buíoch dá gcuirfeá in iúil don Deasc Seirbhísí ECT ar an nguthán ag +353 818 300300<tel:%2B353%20818%20300300> nó ar an ríomhphost chuig service.desk(a)hse.ie<mailto:service.desk@hse.ie> agus ansin glan an ríomhphost seo ded' chóras." "Information in this email (including attachments) is confidential. It is intended for receipt and consideration only by the intended recipient. If you are not an addressee or intended recipient, any use, dissemination, distribution, disclosure, publication or copying of information contained in this email is strictly prohibited. Opinions expressed in this email may be personal to the author and are not necessarily the opinions of the HSE. If this email has been received by you in error we would be grateful if you could immediately notify the ICT Service Desk by telephone at +353 818 300300<tel:%2B353%20818%20300300> or by email to service.desk(a)hse.ie<mailto:service.desk@hse.ie> and thereafter delete this e-mail from your system" ________________________________

1 0

Re: [Koha] Patron Self Registration
by BRANNON, CHRISTOPHER 23 Apr '25

23 Apr '25

We set our expiration date in the patron category that we use for self registration. Ours is set to a month, but you set it to whatever you want there. Basically, staff are required to change the patron category to anything but self registration in order to save changes. We have a lot of validation we add through jquery. When the patron category is changed, it updates the expiration date. I'm not sure why you would require a field that you mark as unwanted. Turn the requirement off. You can't mark it as unwanted on the registration. It is automatically excluded as it is not something a patron would set. I hope that helps. ________________________________ Date: Mon, 21 Apr 2025 16:47:17 -0400 From: Paul Dokken <paul.dokken(a)jaars.org> To: koha(a)lists.katipo.co.nz Subject: [Koha] Patron Self Registration Message-ID: <CAFGey7Z5=-ejTj3fhLpto06gVe=VftiYS3HsKTWkH08nzNNn4w(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Our library has a lot of patrons that we want to allow to set an expiration date on their account when they set it up. We would like to have the staff be warned or automatically change the due date if it is past the expiration date. I manually set an expiration date on a patron and it gave a warning that the card expires on April 28th but it set the due date to May 5th. Can I set up a rule that will change the due date? Also, when I excluded the expiry date in the unwanted fields in the admin setting and checked it as mandatory the label showed up on the self registration page but there was no input box to select the date so there was no way to save a new patron. Any ideas on how to allow an expiration date to be set? -- *Paul Dokken* Information and Digital Technology System Administrator PO Box 248, Waxhaw, NC 28173 | jaars.org (c) 803.235.6861 | paul.dokken(a)jaars.org ------------------------------ Subject: Digest Footer _______________________________________________ Koha mailing list Koha(a)lists.katipo.co.nz https://lists.katipo.co.nz/mailman/listinfo/koha ------------------------------ End of Koha Digest, Vol 234, Issue 12 *************************************

2 1

Out of Office
by Melody Scagnelli-Townley 22 Apr '25

22 Apr '25

Hi, Thank you for your email! I am currently on vacation. I will return on Monday, April 28th. I will be checking emails while I’m away, but my response times will be slower than usual. If you need immediate assistance with returns or renewals, please call the Bayonne Public Library Circulation Desk directly at (201) 858-6971. If you need assistance with your library card or hoopla, please email our Outreach Librarian, Narissa, at npalmer(a)bayonnelibrary.org If you need assistance with historical research, please email our Reference Librarian, Bill, at wfischer(a)bayonnelibrary.org Thank you! Best, Melody

1 0