Koha 17.05.03 security release

Posted on Posted in 17.05, release, security Tagged with

The Koha community is proud to announce the release of Koha 17.05.03.

This is a security release.

Koha 17.05.03 can be downloaded from:

Installation instructions can be found at:

  • Koha Wiki
  • OR in the INSTALL files that come in the tarball

Koha 17.05.03 is a security release.

It includes 3 enhancements, 13 bugfixes and 16 security fixes.

Security bugs fixed

  • [19035] Stored XSS in patron lists – lists.pl
  • [19114] Stored XSS in parcels.pl
  • [19112] Stored XSS in basketheader.pl page
  • [19110] XSS Stored in branches.pl
  • [19100] XSS Flaws in memberentry.pl
  • [19105] XSS Stored in holidays.pl
  • [16069] XSS issue in basket.pl
  • [19079] XSS Flaws in Membership page
  • [19033] XSS Flaws in Currencies and exchange page
  • [19034] XSS Flaws in- Cities – Z39.50/SRU servers administration – Patron categories pages
  • [19050] XSS Flaws in Quick spine label creator
  • [19051] XSS Flaws in – Batch record deletion page – Batch item deletion page – Batch item modification page
  • [19052] XSS Flaws in – vendor search page – Invoice search page
  • [19054] XSS Flaws in Report – Top Most-circulated items
  • [19078] XSS Flaws in System preferences
  • [18726] OPAC XSS – biblionumber

Enhancements

Acquisitions

  • [18839] suggestion.pl: ‘unknown’ is spelled ‘unkown’

Architecture, internals, and plumbing

  • [18361] Koha::Objects->find should accept composite primary keys
  • [18539] Forbid Koha::Objects->find calls in list context

Critical bugs fixed

Patrons

  • [18987] When browsing for a patron by last name the page processes indefinitely

Other bugs fixed

Architecture, internals, and plumbing

  • [18605] Remove TRUNCATE from C4/HoldsQueue.pm

I18N/L10N

  • [18367] Fix untranslatable string from Bug 18264

OPAC

  • [18545] Remove use of onclick from OPAC Cart

Patrons

  • [18832] Missing space between icon and label in button ‘Patron lists’

System Administration

  • [18965] branch transfer limits pagination save bug

Templates

  • [19000] about page – Typo in closing p tag

Test Suite

  • [18951] Some t/Biblio tests are database dependent
  • [18976] Fix t/db_dependent/Auth.t cleanup
  • [18977] Rollback branch in t/db_dependent/SIP/Message.t
  • [18982] selenium tests needs too many prerequisites
  • [18991] Fix cleanup in t/db_dependent/Log.t

Tools

  • [18918] Exporting bibs in CSV when you have no CSV profiles created causes error

System requirements

Important notes:

  • Perl 5.10 is required
  • Zebra is required

Documentation

The Koha manual is maintained in DocBook.The home page for Koha
documentation is

As of the date of these release notes, only the English version of the
Koha manual is available:

The Git repository for the Koha manual can be found at

Translations

Complete or near-complete translations of the OPAC and staff
interface are available in this release for the following languages:

  • English (USA)
  • Arabic (99%)
  • Armenian (99%)
  • Chinese (China) (83%)
  • Chinese (Taiwan) (100%)
  • Czech (95%)
  • Danish (69%)
  • English (New Zealand) (91%)
  • Finnish (99%)
  • French (97%)
  • French (Canada) (91%)
  • German (100%)
  • German (Switzerland) (99%)
  • Greek (78%)
  • Hindi (96%)
  • Italian (99%)
  • Norwegian Bokmål (57%)
  • Occitan (77%)
  • Persian (57%)
  • Polish (100%)
  • Portuguese (99%)
  • Portuguese (Brazil) (85%)
  • Slovak (90%)
  • Spanish (100%)
  • Swedish (96%)
  • Turkish (99%)
  • Vietnamese (71%)

Partial translations are available for various other languages.

The Koha team welcomes additional translations; please see

for information about translating Koha, and join the koha-translate
list to volunteer:

The most up-to-date translations can be found at:

Release Team

The release team for Koha 17.05.03 is

Credits

We thank the following libraries who are known to have sponsored
new features in Koha 17.05.03:

  • Catalyst IT

We thank the following individuals who contributed patches to Koha 17.05.03.

  • Aleisha Amohia (2)
  • Alex Buckley (1)
  • Nick Clemens (2)
  • Tomás Cohen Arazi (2)
  • Marcel de Rooy (9)
  • Jonathan Druart (10)
  • Amit Gupta (20)
  • Chris Kirby (1)
  • Owen Leonard (1)
  • Fridolin Somers (1)
  • Lari Taskula (4)
  • Marc Véron (1)

We thank the following libraries, companies, and other institutions who contributed
patches to Koha 17.05.03

  • ACPL (1)
  • BibLibre (1)
  • bugs.koha-community.org (10)
  • ByWater-Solutions (2)
  • Catalyst (1)
  • ilsleypubliclibrary.org (1)
  • informaticsglobal.com (20)
  • jns.fi (4)
  • Marc Véron AG (1)
  • Rijksmuseum (9)
  • Theke Solutions (2)
  • unidentified (2)

We also especially thank the following individuals who tested patches
for Koha.

  • Aleisha Amohia (1)
  • Amit Gupta (1)
  • Axelle Clarisse (1)
  • Chris Cormack (9)
  • David Cook (1)
  • fcouffignal (1)
  • Frédéric Demians (1)
  • Fridolin Somers (54)
  • Jesse Maseto (1)
  • Jonathan Druart (55)
  • Julian Maurice (1)
  • Katrin Fischer (6)
  • Lee Jamison (5)
  • Marc Véron (3)
  • Mark Tompsett (2)
  • Nick Clemens (8)
  • sonia BOUIS (1)
  • Tomas Cohen Arazi (8)
  • Kyle M Hall (1)
  • Marcel de Rooy (27)

We regret any omissions. If a contributor has been inadvertently missed,
please send a patch against these release notes to
koha-patches@lists.koha-community.org.

Revision control notes

The Koha project uses Git for version control. The current development
version of Koha can be retrieved by checking out the master branch of:

The branch for this version of Koha and future bugfixes in this release
line is 17.05.x.
The last Koha release was 17.05.02, which was released on Jully 27, 2017.

Bugs and feature requests

Bug reports and feature requests can be filed at the Koha bug
tracker at:

He rau ringa e oti ai.
(Many hands finish the work)

Autogenerated release notes updated last on 24 août 2017 07:08:25.