Security Release – Koha 3.20.1
The Koha release team would like to announce the release of Koha 3.20.1, this is a security and a bugfix release.
As such we strongly recommend people running 3.20.0 should upgrade as soon as possible
Special thanks also goes to Raschin Tavakoli and Dimitris Simos from the Combinatorial Security Testing Team of SBA Research for finding and reporting the security bugs.
Please continue reading for the full release notes
RELEASE NOTES FOR KOHA 3.20.1 23 Jun 2015 ======================================================================== Koha is the first free and open source software library automation package (ILS). Development is sponsored by libraries of varying types and sizes, volunteers, and support companies from around the world. The website for the Koha project is http://koha-community.org/ Koha 3.20.1 can be downloaded from: http://download.koha-community.org/koha-3.20.01.tar.gz Installation instructions can be found at: http://wiki.koha-community.org/wiki/Installation_Documentation OR in the INSTALL files that come in the tarball Koha 3.20.1 is a Security and bugfix/maintenance release. Security fixes in 3.20.1 ====================== Lists ---------- 14416 major Stored XSS flaw affects OPAC and Staff interface OPAC ---------- 14412 critical SQL Injection in OPAC Interface 14360 major XSS Injection point 14418 major XSS Flaws in OPAC Interface Staff Client ---------- 14408 critical Path traversal vulnerabilty 14426 critical SQL Injection in Staff Client 14423 major Multiple XSS and XSRF issues in Staff Client Critical bugs fixed in 3.20.1 ====================== Circulation ---------- 12066 major New renew page in staff client doesn't record branch in statistics Tools ---------- 10625 major Inventory/Stocktaking tool cannot handle windows file uploads Other bugs fixed in 3.20.1 ====================== Architecture, internals, and plumbing ---------- 5010 normal Fix OPACBaseURL to include protocol 12320 normal $.cookie('foo', null) deprecated 13265 normal Still too many search cursor cookies 13815 normal Plack loose CGI qw(-utf8) flag creating incorrect utf-8 encoding everywhere 14351 normal Remove given-when from opac-search.pl 11790 minor C4::Charset should not depend on C4::Context 14325 minor Test calls C4::Context::set_userenv 14344 minor Uninitialized value warning C4/Utils/DataTables/Members.pm Cataloging ---------- 14047 normal Sort z39.50 biblio servers by rank in derivate cataloguing doesn't work 14276 minor Keep highlight on the active item in item editor 14327 minor Fix js error "TypeError: events is null" in additem.js Circulation ---------- 14299 normal Today's checkouts not always sorting correctly Command-line Utilities ---------- 14203 trivial Koha-translate error string for non-existent lang removal Database ---------- 14350 minor Missing statement in kohastructure.sql - DROP TABLE IF EXISTS borrower_sync; Hold requests ---------- 14142 minor Holds queue viewer only displays first subtitle from marc keyword mappings I18N/L10N ---------- 13656 normal "Change"/"Set to patron" button for linking a member to an organisation (or child to guarantor) not translatable 14263 normal Export of CSV from item search form does only work in English Notices ---------- 14206 normal Notices using non email templates can't be deleted from the staff client OPAC ---------- 14173 normal Paging on 'recent comments' page in OPAC is not displaying correctly 14313 normal OPAC: Adding a comment makes result browser disappear 14025 minor Fix 856u-links in the OPAC for NORMARC 14184 minor Noisy warns in C4/CourseReserves.pm 14185 minor Noisy warns in opac-readingrecord.pl 14186 minor Noisy warns in opac-reserve.pl 14269 minor OPAC: Small template improvements to full serial history page Patrons ---------- 9314 normal Remove useless code related to the type_only parameter 13970 normal Remove related code to category_type 14338 normal Unable to delete patron images 11929 minor Patron modification error shows borrowernumber 11941 minor "Patron lists" are not easily accessible Reports ---------- 14130 normal Column.def should be updated with descriptions for new columns Serials ---------- 13662 normal Serial permissions: receive_serials System Administration ---------- 14291 minor OpacExportOptions shouldn't say 'separated by |' 14314 trivial System Preferences: Better explanation for syspref 'ShowReviewerPhoto' Templates ---------- 14265 normal Use $.trim instead of trim() in admin/categorie.tt 14266 normal Replace trim() with $.trim() in opac-shareshelf.tt 14279 normal Remove CGI::scrolling_list from issues_avg_stats.pl 12176 minor Remove HTML from additem.pl 13946 minor Change order status 'Pending' to ordered like in database 14267 minor How active is active in additem.tt? 14275 minor Remove CGI::scrolling_list from guided_reports.pl 14329 trivial Useless copy/paste from Template::Plugin::HtmlToText 14330 trivial Remove unused email_sender from sendbasket/sendshelf Test Suite ---------- 14256 normal Tests for TestBuilder fail randomly 14112 minor Silence warnings t/Charset.t Tools ---------- 10355 minor Second click on modification log misses object parameter translate.koha-community.org ---------- 14285 trivial Bengali locale needs to be re-defined New sysprefs in 3.20.1 ====================== System requirements ====================== Important notes: * Perl 5.10 is required * Zebra is required Documentation ====================== The Koha manual is maintained in DocBook.The home page for Koha documentation is http://koha-community.org/documentation/ As of the date of these release notes, only the English version of the Koha manual is available: http://manual.koha-community.org/3.20/en/ The Git repository for the Koha manual can be found at http://git.koha-community.org/gitweb/?p=kohadocs.git;a=summary Translations ====================== Complete or near-complete translations of the OPAC and staff interface are available in this release for the following languages: * English (USA) Partial translations are available for various other languages. The Koha team welcomes additional translations; please see http://wiki.koha-community.org/wiki/Translating_Koha for information about translating Koha, and join the koha-translate list to volunteer: http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate The most up-to-date translations can be found at: http://translate.koha-community.org/ Release Team ====================== The release team for Koha 3.20.1 is Release Manager: Tomás Cohen Arazi <email@example.com> QA Manager: Katrin Fischer <Katrin.Fischer@bsz-bw.de> Documentation Manager: Nicole C. Engard <firstname.lastname@example.org> Translation Manager: Bernardo Gonzalez Kriegel <email@example.com> QA Team: Jonathan Druart <firstname.lastname@example.org> Brendan Gallagher <email@example.com> Kyle Hall <firstname.lastname@example.org> Paul Poulain <email@example.com> Martin Renvoize <firstname.lastname@example.org> Marcel de Rooy <email@example.com> Bug Wrangler: Magnus Enger <firstname.lastname@example.org> Packaging Manager: Robin Sheat <email@example.com> Release Maintainer (3.18.x): Chris Cormack <firstname.lastname@example.org> Release Maintainer (3.16.x): Mason James <email@example.com> Release Maintainer (3.14.x): Fridolin Somers <firstname.lastname@example.org> Credits ====================== We thank the following libraries who are known to have sponsored new features in Koha 3.20.1: We thank the following individuals who contributed patches to Koha 3.20.1. * Aleisha (5) * Nicole C. Engard (1) * Tomás Cohen Arazi (3) * David Cook (2) * Chris Cormack (16) * Indranil Das Gupta (4) * Marcel de Rooy (8) * Jonathan Druart (18) * Magnus Enger (1) * Katrin Fischer (5) * Bernardo González Kriegel (6) * Kyle M Hall (4) * Josef Moravec (1) * Dobrica Pavlinusic (1) * Zeno Tajoli (1) * Mark Tompsett (4) * Marc Véron (3) We thank the following libraries, companies, and other institutions who contributed patches to Koha 3.20.1 * BSZ BW (5) * BibLibre (9) * ByWater-Solutions (5) * Catalyst (16) * Cineca (1) * Libriotech (1) * Prosentient Systems (2) * Rijksmuseum (8) * Universidad Nacional de Córdoba (6) * koha-community.org (9) * rot13.org (1) * theke.io (3) * unidentified (14) * veron.ch (3) We also especially thank the following individuals who tested patches for Koha 3.20.1. * Aleisha (1) * Brendan Gallagher (1) * Cédric Vita (1) * Chris Cormack (78) * Frederic Demians (1) * Gaetan Boisson (1) * Jonathan Druart (46) * Katrin Fischer (36) * Liz Rea (1) * Marc Veron (1) * Marc Véron (9) * Mark Tompsett (7) * Nick Clemens (1) * Paola Rossi (1) * Signed-off-by:Heather Braum (1) * Tomas Cohen Arazi (74) * Indranil Das Gupta (2) * Indranil Das Gupta (L2C2 Technologies) (8) * Kyle M Hall (13) * Bernardo Gonzalez Kriegel (17) * Marcel de Rooy (11) We regret any omissions. If a contributor has been inadvertently missed, please send a patch against these release notes to email@example.com. Revision control notes ====================== The Koha project uses Git for version control. The current development version of Koha can be retrieved by checking out the master branch of git://git.koha-community.org/koha.git The branch for this version of Koha and future bugfixes in this release line is 3.20.x. The last Koha release was 3.16.9, which was released on March 29, 2015. Bugs and feature requests ====================== Bug reports and feature requests can be filed at the Koha bug tracker at http://bugs.koha-community.org/ He rau ringa e oti ai. (Many hands finish the work) ##### Autogenerated release notes updated last on 23 Jun 2015 07:28:54 Z #####