- Koha - lists.katipo.co.nz

Re: [Koha] SECURITY release: MARC::File::XML 1.0.2
by Paul A 23 Jan '14

23 Jan '14

At 03:22 PM 1/22/2014 -0800, Galen Charlton wrote: >Hi, > >On Wed, Jan 22, 2014 at 3:15 PM, Paul A <paul.a(a)navalmarinearchive.com> wrote: > > Could you please advise on 1.0.2 versus 0.92-1 -- the devil is always > in the > > details. > >All versions of MARC::File::XML prior to 1.0.2 are subject to the >vulnerability, including the Debian- and Ubuntu-packaged 0.92-1. I >recommend that you proceed with updating libmarc-xml-perl. That's exactly what I did -- Package: libmarc-xml-perl Version: 1.0.2-1koha1 but... apt-cache show (see my previous email) gives "internally" (not the package name): Architecture: all Version: 0.92-1 Best - Paul

1 0

Re: [Koha] SECURITY release: MARC::File::XML 1.0.2
by David Cook 23 Jan '14

23 Jan '14

Hi Galen: If/when libmarc-xml-perl gets added to debian.koha-community.org, will Koha users who installed via the Debian packages get the update automatically? -David -----Original Message----- Message: 4 Date: Tue, 21 Jan 2014 10:32:23 -0800 From: Galen Charlton <gmc(a)esilibrary.com> To: Koha-List <koha(a)lists.katipo.co.nz> Subject: [Koha] SECURITY release: MARC::File::XML 1.0.2 Message-ID: <CAPLnt652-mSU3RHD3=ZMX7iJAxJMeBNJAu0EZesymmJVhc2LJg(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Hi, I have uploaded [1] version 1.0.2 of MARC::File::XML, a Perl module which is used by Koha. This is a security release that repairs an XML external entity (XXE) vulnerability. I know of at least one way that the vulnerability could be used by an individual who has staff interface credentials to view the contents of arbitrary files on the Koha server. Consequently, I recommend that Koha users arrange to upgrade MARC::File::XML promptly. On many Linux systems, this can be done by running the following command with root privileges: cpan MARC::File::XML If the installation fails, the most likely reason is that your version of ExtUtils::MakeMaker is not recent enough. You can fix this by running the following command first, then attempting the installation of MARC::File::XML again. cpan ExtUtils::MakeMaker Please note that at the time of this writing, not all CPAN mirrors will have the most recent version of MARC::File::XML. You can check the version of MARC::File::XML that is installed by running: perl -MMARC::File::XML -e 'print $MARC::File::XML::VERSION, "\n"' I imagine that an updated Debian package of libmarc-xml-perl will be made available on debian.koha-community.org at some point as well. For any users of Koha on Fedora that are out there, Dan Scott will be packaging MARC::File::XML 1.0.2 shortly. Please note that older releases of MARC::File::XML prior to the switch to XML::LibXML are also vulnerable. Here is the relevant change log entry: 1.0.2 Tue Jan 21 17:18:37 UTC 2014 - MARC::File::XML will now die upon parsing a record that declares an external entity and tries to use it. This prevents the potential unwanted disclosure of the contents of files on the server by applications that embed this module. If, for some reason, an application needs to process MARCXML records that contain external entities, set_parser() can be used to force the use of an XML::LibXML parser that is configured to process external entities. The issue was reported by John Lightsey. [1] https://metacpan.org/release/GMCHARLT/MARC-XML-1.0.2 Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc(a)esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org

3 2

Re: [Koha] How to run Koha fines script manually
by Vimal Kumar V. 22 Jan '14

22 Jan '14

Dear Robin, Thank you for the information. One doubt too, in which time cron works according to the below mentioned script? 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) It work on 6 AM 25 minutes? Regards, -- Vimal Kumar V. Technical Assistant Mahatma Gandhi University Library Kottayam, Kerala- 686 560 Web: http://www.vimalkumar.info Blog: http://linuxhalwa.blogspot.com http://kohageek.blogspot.in http://moovandan.blogspot.in --------------------------------------------------------------------------- "I forget what I was taught. I only remember what I have learnt" -Patrick White

2 1

Problems with frameworks
by Mark Tompsett 22 Jan '14

22 Jan '14

Greetings, I am use 3.14.x and master, though I think this problem goes back a bit further. I am using MARC21. I log into the staff client. I click Koha administration. I click MARC bibliographic framework. In the left hand side, I scroll down to find MARC bibliographic framework test. I click it. I am then shown a pretty table, which tells me “You have 1 error(s) in your MARC configuration. Please fix them before using Koha”. I have back end access, so I figured I’d try to make sense of the message. I see it ran http://192.168.45.28:8080/cgi-bin/koha/admin/checkmarc.pl, so I take a look at the source for admin/checkmarc.pl to see if I can determine how the error was triggered. The second line in the table says “item fields”, so I figure it is talking about lines 87 to 110 in master. I see the SQL is: select tagfield,tab,kohafield from marc_subfield_structure where kohafield like "items.%" and tab >=0; So, I try running that in my backend mysql client. There are 447 rows, and most are on tab 10, but tag 541 isn’t always? It’s items.stocknumber and so I try a different query: select tagfield,tagsubfield, tab,kohafield,frameworkcode from marc_subfield_structure where kohafield like "items.stocknumber"; And here in begins the confusion. I see that 952$i and 541$e are sometimes mapping to the same kohafield items.stocknumber, and occasionally they are not. I also see 541$e sometimes on tag 5, 9, or 10. So, can anyone clear up what they should map to, if anything, and what tab they are supposed to be on? GPML, Mark Tompsett

1 0

I tried the MARC bibliographic framework test and got this: You have 2 error(s) in your MARC configuration. Please fix them before using Koha itemnum The field itemnum MUST be mapped The corresponding subfield MUST be in with -1 (ignore) tab item fields ALL items fields MUST : be mapped to the same tag, and they must all be in the 10 (items) tab
by Joseph Longshak Longshak 22 Jan '14

22 Jan '14

I tried the MARC bibliographic framework test and got this: You have 2 error(s) in your MARC configuration. Please fix them before using Koha itemnum The field itemnum MUST be mapped The corresponding subfield MUST be in with -1 (ignore) tab item fields ALL items fields MUST : be mapped to the same tag, and they must all be in the 10 (items) tab What could be wrong? I guess there must have been an a solution to this Joe Longshak Abuja Nigeria

1 0

koha analytics mass import and "In:" ot showing
by schnydszch 22 Jan '14

22 Jan '14

Hi koha community! I'm trying out bulk import of analytics into koha 3.14. To trg it out first, I only import one record, with the following data i 773 field: $wSER-000001$tNewsweek$g121 (My 10 93). My host record has in 001 SER-000001. Doing this, i don't see the part "In: Newsweek". Which appears if I do it by manually linking it to host item. Which contradicts my need to bulk import analytic records. I tried adding in subfield 0 & 9 corresponding biblioitemnumber and itemnumber but still to no avail. Is there a special script that i need to run in order to get what I need? Thanks in advance and cheers! -- View this message in context: http://koha.1045719.n5.nabble.com/koha-analytics-mass-import-and-In-ot-show… Sent from the Koha-general mailing list archive at Nabble.com.

1 1

Duplicating Records = Replacing Records?
by Andrea Furin 22 Jan '14

22 Jan '14

Hi. When I try to duplicate a record, koha overwrites the old one: searching for that title (opac and biblio) returns only the last modified record - with duble koha id. Some solutions? One is to delete fields: 000@ 001@ 005@ 100a --

1 0

bugs find while installation of koha 3.14
by shiyas1234 22 Jan '14

22 Jan '14

sir, i found the following errors while installing the KOHA v3.14. An screenshot attachment of the error is attached with this mail. Please do the needful to fix the bugs. <http://koha.1045719.n5.nabble.com/file/n5784135/Screenshot.png> -- View this message in context: http://koha.1045719.n5.nabble.com/bugs-find-while-installation-of-koha-3-14… Sent from the Koha-general mailing list archive at Nabble.com.

3 4

SECURITY release: MARC::File::XML 1.0.2
by Galen Charlton 22 Jan '14

22 Jan '14

Hi, I have uploaded [1] version 1.0.2 of MARC::File::XML, a Perl module which is used by Koha. This is a security release that repairs an XML external entity (XXE) vulnerability. I know of at least one way that the vulnerability could be used by an individual who has staff interface credentials to view the contents of arbitrary files on the Koha server. Consequently, I recommend that Koha users arrange to upgrade MARC::File::XML promptly. On many Linux systems, this can be done by running the following command with root privileges: cpan MARC::File::XML If the installation fails, the most likely reason is that your version of ExtUtils::MakeMaker is not recent enough. You can fix this by running the following command first, then attempting the installation of MARC::File::XML again. cpan ExtUtils::MakeMaker Please note that at the time of this writing, not all CPAN mirrors will have the most recent version of MARC::File::XML. You can check the version of MARC::File::XML that is installed by running: perl -MMARC::File::XML -e 'print $MARC::File::XML::VERSION, "\n"' I imagine that an updated Debian package of libmarc-xml-perl will be made available on debian.koha-community.org at some point as well. For any users of Koha on Fedora that are out there, Dan Scott will be packaging MARC::File::XML 1.0.2 shortly. Please note that older releases of MARC::File::XML prior to the switch to XML::LibXML are also vulnerable. Here is the relevant change log entry: 1.0.2 Tue Jan 21 17:18:37 UTC 2014 - MARC::File::XML will now die upon parsing a record that declares an external entity and tries to use it. This prevents the potential unwanted disclosure of the contents of files on the server by applications that embed this module. If, for some reason, an application needs to process MARCXML records that contain external entities, set_parser() can be used to force the use of an XML::LibXML parser that is configured to process external entities. The issue was reported by John Lightsey. [1] https://metacpan.org/release/GMCHARLT/MARC-XML-1.0.2 Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc(a)esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org

2 1

How to run Koha fines script manually
by Vimal Kumar V. 21 Jan '14

21 Jan '14

Dear Friends, Most of the libraries have installed Koha in ordinary computer and they shut down it after working hours. Fine will not calculate in this context. Fine calculation in Koha occur in 12 AM midnight. You can manage fine calculation by running fine calculation script. Here is the method, Open *Applications > Accessories > Terminal* Apply following commands, *sudo su* *cd /etc/cron.daily/* *./koha-common* Run this script at opening hour of the library. Regards, -- Vimal Kumar V. Technical Assistant Mahatma Gandhi University Library Kottayam, Kerala- 686 560 Web: http://www.vimalkumar.info Blog: http://linuxhalwa.blogspot.com http://kohageek.blogspot.in http://moovandan.blogspot.in --------------------------------------------------------------------------- "I forget what I was taught. I only remember what I have learnt" -Patrick White

2 1