- Koha - lists.katipo.co.nz

Cross site scripting
by araik＠flib.sci.am 26 Nov '13

26 Nov '13

Dear community, In our Koha version 3.12.01 which has worked on Ubuntu 12.04 we have some problems. Recently our Web provider checked Koha security through "Acunetix" Web application security programm and founded some high-severity type vulnerabilities. First threat : ********************************** Cross site scripting (verified) Affects Variation /cgi-bin/koha/opac-search.pl /cgi-bin/koha/opac-search.pl URL encoded GET input count was set to 50'"()&%<ScRiPt >prompt(901653)</ScRiPt> GET /cgi-bin/koha/opac-search.pl?count=50%27%22%28%29%26%25%3cScRiPt%20%3eprompt%28901653%29%3c%2 fScRiPt%3e&format=rss2&idx=pb,wrdl&limit=mc-itype,phr:AR&q=1&sort_by=acqdate_dsc HTTP/1.1 Referer: http://library.parliament.am:80/ (line truncated) ...00%2500query_cgi%2508%2580%2505%2500%2500%2500total%250A%2511callnum%252Cwrdl%253A%25201%2 52C%2520%250A%2500%2500%2500query_desc%2504%2503%2504%2500%2500%2500%2506%25C5Q%258FR%2500%25 00%2500%2500%2504%2500%2500%2500time%250A7format%253Drss2%2526idx%253Dsu%25252Cwrdl%2526limit %253Dmc-itype%25252Cphr%25253AAR%2526q%253D1%2509%2500%2500%2500query_cgi%2508%2580%2505%2500 %2500%2500total%250A%251Bsu%252Cwrdl%253A%25201%252C%2520mc-itype%252Cphr%253AAR%250A%2500%25 00%2500query_desc; KohaOpacLanguage=en Host: library.parliament.am Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Acunetix-Product: WVS/8.0 (Acunetix Web Vulnerability Scanner - NORMAL) Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htm Accept: */* **************************************** Second : *************************************** Application error message Affects Variation /cgi-bin/koha/opac-search.pl /cgi-bin/koha/opac-search.pl URL encoded GET input count was set to '"() Error message found: Internal Server Error GET /cgi-bin/koha/opac-search.pl?count=%27%22%28%29&format=rss2&idx=ti&q=1&sort_by=acqdate_dsc HTTP/1.1 (line truncated) ...00%2500query_cgi%2508%2580%2505%2500%2500%2500total%250A%2511callnum%252Cwrdl%253A%25201%2 52C%2520%250A%2500%2500%2500query_desc%2504%2503%2504%2500%2500%2500%2506%25C5Q%258FR%2500%25 00%2500%2500%2504%2500%2500%2500time%250A7format%253Drss2%2526idx%253Dsu%25252Cwrdl%2526limit %253Dmc-itype%25252Cphr%25253AAR%2526q%253D1%2509%2500%2500%2500query_cgi%2508%2580%2505%2500 %2500%2500total%250A%251Bsu%252Cwrdl%253A%25201%252C%2520mc-itype%252Cphr%253AAR%250A%2500%25 00%2500query_desc; KohaOpacLanguage=en Host: library.parliament.am Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Acunetix-Product: WVS/8.0 (Acunetix Web Vulnerability Scanner - NORMAL) Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htm Accept: */* **************************** Security programme results see an attached. How to prevent xss attacs and protect opac-search.pl ? Best regards, Araik

2 1

xss problem
by araik＠flib.sci.am 26 Nov '13

26 Nov '13

Dear community, In our Koha version 3.12.01 which has worked on Ubuntu 12.04 we have some problems. Recently our Web provider checked Koha security through "Acunetix" Web application security programm and founded some high-severity type vulnerabilities. First threat : ********************************** Cross site scripting (verified) Affects Variation /cgi-bin/koha/opac-search.pl URL encoded GET input count was set to 50'"()&%<ScRiPt >prompt(901653)</ScRiPt> GET /cgi-bin/koha/opac-search.pl?......... **************************************** Second : *************************************** Application error message Affects Variation /cgi-bin/koha/opac-search.pl /cgi-bin/koha/opac-search.pl URL encoded GET input count was set to '"() Error message found: Internal Server Error GET /cgi-bin/koha/opac-search.pl?count=%27%22%28%29&format=rss2&idx=ti&q=1&sort_by=acqdate_dsc HTTP/1.1 (line truncated)........ **************************** Security programme results see an attached. How to prevent xss attacs and protect opac-search.pl ? Best regards, Araik

1 0

Printing overdue notices or bills for Patrons from Koha with NO Email
by Lisa Gugliotti 25 Nov '13

25 Nov '13

How do other Koha libraries deal with sending bills to patrons that do not have an email on file? I've tried to use various Directory/Catalog Mail Merge techniques and tutorials using Microsoft Word 2010, a Word Add-In called Many to One, but it's just not working out the way it's supposed to work. Short of sending 5 or 6 mail merged sheets per cardnumber, how do other libraries get around this? Thank you, Lisa Gugliotti Reference Librarian The Henry Carter Hull Library 10 Killingworth Turnpike Clinton, CT 06413 860-669-2342 lisa(a)hchlibrary.org www.hchlibrary.org "Like" Us on Facebook https://www.facebook.com/hchlibrary Follow Us on Twitter https://twitter.com/hchlibrary

2 1

Upgrading using apt-get
by Stefano Bargioni 25 Nov '13

25 Nov '13

After some tests for migrating from Koha 3.2.7, I'm going to start using Koha 3.12.5 in a production environment, on Debian. In the meanwhile Koha had two patches (3.12.6, 3.12.7) and one release (3.14). Will my next apt-get upgrade Koha to 3.12.7? Or to Koha 3.14, if its deb package becomes available? If to Koha 3.12.7, how can I upgrade to Koha 3.14 when my library will be ready to move? Thanks. Stefano

2 1

migrating koha
by rocky bang 25 Nov '13

25 Nov '13

hiii all, I have multiple koha instance running on one system opensuse 11. I want to shift one of the koha to another system ubuntu 12.04 as it is with out any changes. I have copied source code and paste it on another server ubuntu 12.04 i then created new koha instance and import the dump file into new koha instance, every thing goes fine but some of the searching feature are changed. On previous system opensuse when i search for records its showing me in unicode local laguage, but on the new instance records are in english language. how can i migrate the koha with out any changes like this.

2 1

New featur: Incremental Fine and Purchase sugestion restriction
by Vinod Kumar Mishra 25 Nov '13

25 Nov '13

Dear Developers, I feel that incremental fine policy needs to be incorporated for example some libraries charge fine for first seven day's 1 USD/Rupees then 5 USD/Rupees etc. similarly Purchase suggestion should be also restricted by category of users like all category of users in academic library are not entitle for purchase suggestions and only faculty can place purchase request so it should be also incorporated. For fine it can be added in circulation policy module and and Purchase suggestions it can be simply placed in Patron category creation module (Online purchase suggestion Yes/No). I have already requested this feature in bug site. Thanking You With regards, Vinod Kumar Mishra, Assistant Librarian, Biju Patnaik Central Library, NIT Rourkela, Mob:91+9439420860 91+6612462103 (O) email: vinod_librarian(a)rediffmail.com : mishravk79(a)gmail.com

2 1

Koha (3.14) Live DVD
by Vinod Kumar Mishra 24 Nov '13

24 Nov '13

Dear All, Please click the link below to get the koha latest version Live DVD (easykoha.iso). However, old stable version (KohaLiveDVD.iso) is also available from the link. Please note that instructions and ID/Passwords are similar in all versions. Live DVD : http://sourceforge.net/projects/vkmkoha/files/ Installation Video: http://www.youtube.com/watch?v=2mg8h394E28 Thanking You. With regards, Vinod Kumar Mishra, Assistant Librarian, Biju Patnaik Central Library, NIT Rourkela, Mob:91+9439420860 91+6612462103 (O) email: vinod_librarian(a)rediffmail.com : mishravk79(a)gmail.com

1 0

Re: [Koha] How to record bound volume serials?
by Chris Cormack 23 Nov '13

23 Nov '13

On 23 November 2013 19:01, Vinod Kumar Mishra <vinod_librarian(a)rediffmail.com> wrote: > Dear, > > This is also my question but i feel bond volume needs to be re-accessioned and you can add it as a item in that bibliographic record. But i also want to know what to do with loose issues? which is no more relevant after binding it. > I would use Analytics to link the bound volume to the individual issue records, but remove the items from the individual ones http://manual.koha-community.org/3.14/en/cataloging.html#cataloganalytics Chris > On Sat, 23 Nov 2013 01:26:27 +0530 wrote >>I shall be grateful if anybody can guide me in this matter. I understand > > Koha does not use 853 Tag. Say, I have a serial "All India Cooperative > > Bulletin" and received its 4 issues of volume 53 in Koha. Individual issue > > with unique bar code. Now, it has been bound into a physical volume > > > > How do I record this bound volume of of the serial in Koha? > > What happens to loose issue item records? > > > > -- > > Arup Raychaudhury > > _______________________________________________ > > Koha mailing list http://koha-community.org > > Koha(a)lists.katipo.co.nz > > http://lists.katipo.co.nz/mailman/listinfo/koha > > > > With regards, > Vinod Kumar Mishra, > Assistant Librarian, > Biju Patnaik Central Library, > NIT Rourkela, > Mob:91+9439420860 > 91+6612462103 (O) > email: vinod_librarian(a)rediffmail.com > : mishravk79(a)gmail.com > _______________________________________________ > Koha mailing list http://koha-community.org > Koha(a)lists.katipo.co.nz > http://lists.katipo.co.nz/mailman/listinfo/koha

1 0

How to record bound volume serials?
by Arup Raychaudhury 23 Nov '13

23 Nov '13

I shall be grateful if anybody can guide me in this matter. I understand Koha does not use 853 Tag. Say, I have a serial "All India Cooperative Bulletin" and received its 4 issues of volume 53 in Koha. Individual issue with unique bar code. Now, it has been bound into a physical volume How do I record this bound volume of of the serial in Koha? What happens to loose issue item records? -- Arup Raychaudhury

2 1

Koha 3.12.7 released
by Tomas Cohen Arazi 22 Nov '13

22 Nov '13

The Koha community is proud to announce the release of 3.12.7. This is a maintenance release and contains some enhancements and several bugfixes. As always you can download the release from http://download.koha-community.org Please read more for the full release notes: RELEASE NOTES FOR KOHA 3.12.7 22 Nov 2013 ======================================================================== Koha is the first free and open source software library automation package (ILS). Development is sponsored by libraries of varying types and sizes, volunteers, and support companies from around the world. The website for the Koha project is http://koha-community.org/ Koha 3.12.7 can be downloaded from: http://download.koha-community.org/koha-3.12.07.tar.gz Installation instructions can be found at: http://wiki.koha-community.org/wiki/Installation_Documentation OR in the INSTALL files that come in the tarball Koha 3.12.7 is a bugfix/maintenance release. It includes 8 enhancements and 42 bugfixes. Enhancements in 3.12.7 ====================== OPAC ---------- 7813 Add ability to delete local cover images Packaging ---------- 10622 Add --sip and --nosip switches to koha-list 10624 Koha-common.init should implement the 'status' option switch Patrons ---------- 9372 Automatic carriage return in message_queue where content_type is html 10894 ID required for mainaddress fieldset in create new patron Serials ---------- 10570 Show internal note from subscription in results on check expiration page Templates ---------- 10803 "Make payment" in circ is not easily translatable Tools ---------- 9618 Add support for intranetuserjs to labels/spinelabel-print.pl Critical bugs fixed in 3.12.7 ====================== Architecture, internals, and plumbing ---------- 9299 major For loop in Auth_with_ldap.pm requires an extended patron attribute to be set or LDAP logins fail 10897 major T/ILSDI_Services.t is db dependent Authentication ---------- 10925 major LDAP Auth fails if DEBUG is enable Circulation ---------- 10016 critical SelfCheckTimeout not logging patron out 10663 critical Holds never block renewals Notices ---------- 11218 critical Due notices broken / not generated Serials ---------- 10430 major Status filter not working in serial claims when translated Other bugs fixed in 3.12.7 ====================== Acquisitions ---------- 8821 normal Receive shipment page should hide inactive funds like new order form does 10847 trivial Open external link to website of a vendor in new tab/window Architecture, internals, and plumbing ---------- 10872 minor C4::Items GetHiddenItems fix and optimization 10305 trivial _increment_barcode is called twice 11269 trivial Latest MARC::Record makes visible some wrong usage of field->subfield in C4::Search Browser compatibility ---------- 10376 normal Printing cart does not work under IE9 Cataloging ---------- 11054 normal Creating a child record has problems with accented Latin characters 10331 trivial Little errors in unimarc_field_4XX.pl (punctuation) 10687 trivial Delete erroneous tags 68a and 68b on default MARC21 auth framework Circulation ---------- 10027 normal Fine details not showing when printing a fine 9943 minor Pay fines page "Pay selected" button give invalid amount when nothing is selected Command-line Utilities ---------- 10810 trivial Fix synopsis for -html option to overdue_notices.pl Developer documentation ---------- 10967 trivial POD ERROR in acqui/booksellers.pl Documentation ---------- 7764 normal INSTALL.ubuntu needs to be updated Hold requests ---------- 10731 minor IntranetSlipPrinterJS is not working for hold slips I18N/L10N ---------- 10948 normal Some strings in the authority result list turned out untranslatable 7478 minor Template/translation problem in catalogue_out.tt 8070 minor <pre> block produced by showmarc.pl really not good in RTL languages 10841 minor Edit/Delete item context links in items table are not translatable 10871 trivial Confirmation message for deleting news entries is not translatable Notices ---------- 10720 normal Substitution term in overdue notices shouldn't be removed even if they don't match OPAC ---------- 10619 normal Sco.css missing for CCSR OPAC templates 10564 minor Use OPACURLOpenInNewWindow in UNIMARCslim2OPACResults.xsl Packaging ---------- 10617 trivial Init script cleanup Patrons ---------- 10924 normal Contact note not updating via opac Reports ---------- 10718 normal Items with no checkouts report does not work Searching ---------- 5645 normal Z39.50 search from search results not parsing query correctly 10684 normal Koha search dies on undecodable records Serials ---------- 10689 minor Public note does not appear in subscriptions search SIP2 ---------- 9531 normal Make SIP2 message terminator configurable via SIPconfig.xml 10817 normal SIPserver does not return holds info when requested Staff Client ---------- 10911 normal Records with 880 fields have broken details links in intranet search results using XSLT. Templates ---------- 10888 normal Don't hide authorities module from users without permission to edit authorities 10465 trivial Reference to fields 780 and 785 in UNIMARC XSLT should be removed Web services ---------- 10667 normal ILS-DI: AuthenticatePatron should also work with cardnumber System requirements ====================== Important notes: * Perl 5.10 is required * Zebra is required Documentation ====================== The Koha manual is maintained in DocBook.The home page for Koha documentation is http://koha-community.org/documentation/ As of the date of these release notes, only the English version of the Koha manual is available: http://manual.koha-community.org/3.12/en/ The Git repository for the Koha manual can be found at http://git.koha-community.org/gitweb/?p=kohadocs.git;a=summary Translations ====================== Complete or near-complete translations of the OPAC and staff interface are available in this release for the following languages: * English (USA) * Arabic (89%) * Armenian (100%) * Chinese (China) (100%) * Chinese (Taiwan) (99%) * Czech (100%) * Danish (99%) * English (New Zealand) (92%) * French (100%) * French (Canada) (97%) * German (100%) * German (Switzerland) (99%) * Greek (54%) * Italian (99%) * Kurdish (78%) * Norwegian Bokmål (64%) * Polish (73%) * Portuguese (100%) * Portuguese (Brazil) (92%) * Slovak (99%) * Spanish (100%) * Swedish (97%) * Turkish (99%) Partial translations are available for various other languages. The Koha team welcomes additional translations; please see http://wiki.koha-community.org/wiki/Translating_Koha for information about translating Koha, and join the koha-translate list to volunteer: http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate The most up-to-date translations can be found at: http://translate.koha-community.org/ Release Team ====================== The release team for Koha 3.12.7 is Release Manager: Jared Camins-Esakov <jcamins(a)cpbibliography.com> Documentation Manager: Nicole C Engard <nengard(a)gmail.com> Installation Documentation Managers: Samuel Desseaux <samuel.desseaux(a)ecp.fr> Mason James <mtj(a)kohaaloha.com> Translation Manager: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> QA Manager: Katrin Fischer <Katrin.Fischer(a)bsz-bw.de> QA Team: Chris Cormack <chrisc(a)catalyst.net.nz> Marcel de Rooy <M.de.Rooy(a)rijksmuseum.nl> Jonathan Druart <jonathan.druart(a)biblibre.com> Brendan Gallagher <brendan(a)bywatersolutions.com> Kyle Hall <kyle(a)bywatersolutions.com> Mason James <mtj(a)kohaaloha.com> Paul Poulain <paul.poulain(a)biblibre.com> Bug Wranglers: Magnus Enger <magnus(a)enger.priv.no> Packaging Manager: Robin Sheat <robin(a)catalyst.net.nz> Live CD Manager: Vimal Kumar V. VM Manager: Samuel Desseaux <samuel.desseaux(a)ecp.fr> Release Maintainer (3.8.x): Chris Hall <chrish(a)catalyst.net.nz> Release Maintainer (3.10.x): Bernardo Gonzalez Kriegel < bgkriegel(a)gmail.com> Release Maintainer (3.12.x): Tomás Cohen Arazi <tomascohen(a)gmail.com> Credits ====================== We thank the following libraries who are known to have sponsored new features in Koha 3.12.7: * Universidad Nacional de Cordoba We thank the following individuals who contributed patches to Koha 3.12.7. * 8 Tomas Cohen Arazi * 1 D Ruth Bavousett * 1 Jared Camins-Esakov * 2 Colin Campbell * 13 Galen Charlton * 4 Jonathan Druart * 2 Magnus Enger * 11 Katrin Fischer * 8 Kyle M Hall * 1 Srdjan Jankovic * 1 Janusz Kaczmarek * 1 Bernardo Gonzalez Kriegel * 1 Ketan Kulkarni * 7 Owen Leonard * 2 Sophie Meynieux * 1 David Roberts * 1 Marcel de Rooy * 6 Fridolyn SOMERS * 1 Mathieu Saby * 2 Mark Tompsett We thank the following companies who contributed patches to Koha 3.12.7 * 7 ACPL * 11 BSZ BW * 12 BibLibre * 8 ByWater-Solutions * 1 C & P Bibliography * 1 Catalyst * 13 Equinox * 2 Libriotech * 3 PTFS-Europe * 1 Rijksmuseum * 1 Université Rennes 2 * 1 carvingit.com * 13 unidentified We also especially thank the following individuals who tested patches for Koha 3.12.7. * 2 Nuño López Ansótegui * 75 Tomas Cohen Arazi * 71 Galen Charlton * 1 David Cook * 9 Chris Cormack * 1 Frédéric Demians * 13 Jonathan Druart * 1 Magnus Enger * 25 Katrin Fischer * 2 Brendan Gallagher * 9 Kyle M Hall * 4 Mason James * 14 Bernardo Gonzalez Kriegel * 7 Owen Leonard * 1 Melia Meggs * 1 Josef Moravec * 4 Liz Rea * 2 Campbell Reid-Tait * 4 Marcel de Rooy * 2 Paola Rossi * 1 Mathieu Saby * 1 Adrien Saurat * 4 Robin Sheat * 2 Srdjan * 1 Mark Tompsett * 2 Ed Veal * 1 Marc Veron We regret any omissions. If a contributor has been inadvertently missed, please send a patch against these release notes to koha-patches(a)lists.koha-community.org. Revision control notes ====================== The Koha project uses Git for version control. The current development version of Koha can be retrieved by checking out the master branch of git://git.koha-community.org/koha.git The branch for this version of Koha and future bugfixes in this release line is 3.12.x. The last Koha release was 3.12.17, which was released on October 28, 2013. Bugs and feature requests ====================== Bug reports and feature requests can be filed at the Koha bug tracker at http://bugs.koha-community.org/ He rau ringa e oti ai. (Many hands finish the work)

1 0