Security Release – Koha 3.20.1

The Koha release team would like to announce the release of Koha 3.20.1, this is a security and a bugfix release.

As such we strongly recommend people running 3.20.0 should upgrade as soon as possible

Special thanks also goes to Raschin Tavakoli and Dimitris Simos from the Combinatorial Security Testing Team of SBA Research for finding and reporting the security bugs.

Please continue reading for the full release notes

 

RELEASE NOTES FOR KOHA 3.20.1
23 Jun 2015
========================================================================

Koha is the first free and open source software library automation package 
(ILS). Development is sponsored by libraries of varying types and sizes, 
volunteers, and support companies from around the world.  
The website for the Koha project is 

    http://koha-community.org/

Koha 3.20.1 can be downloaded from:

    http://download.koha-community.org/koha-3.20.01.tar.gz

Installation instructions can be found at:

    http://wiki.koha-community.org/wiki/Installation_Documentation
    
    OR in the INSTALL files that come in the tarball


Koha 3.20.1 is a Security and bugfix/maintenance release.



Security fixes in 3.20.1
======================

Lists
----------
	14416	major	Stored XSS flaw affects OPAC and Staff interface

OPAC
----------
	14412	critical	SQL Injection in OPAC Interface
	14360	major	XSS Injection point
	14418	major	XSS Flaws in OPAC Interface

Staff Client
----------
	14408	critical	Path traversal vulnerabilty
	14426	critical	SQL Injection in Staff Client
	14423	major	Multiple XSS and XSRF issues in Staff Client


Critical bugs fixed in 3.20.1
======================


Circulation
----------
	12066	major	New renew page in staff client doesn't record branch in statistics

Tools
----------
	10625	major	Inventory/Stocktaking tool cannot handle windows file uploads


Other bugs fixed in 3.20.1
======================


Architecture, internals, and plumbing
----------
	5010	normal	Fix OPACBaseURL to include protocol
	12320	normal	$.cookie('foo', null) deprecated
	13265	normal	Still too many search cursor cookies
	13815	normal	Plack loose CGI qw(-utf8) flag creating incorrect utf-8 encoding everywhere
	14351	normal	Remove given-when from opac-search.pl
	11790	minor	C4::Charset should not depend on C4::Context
	14325	minor	Test calls C4::Context::set_userenv
	14344	minor	Uninitialized value warning C4/Utils/DataTables/Members.pm

Cataloging
----------
	14047	normal	Sort z39.50 biblio servers by rank in derivate cataloguing doesn't work
	14276	minor	Keep highlight on the active item in item editor
	14327	minor	Fix js error "TypeError: events is null" in additem.js

Circulation
----------
	14299	normal	Today's checkouts not always sorting correctly

Command-line Utilities
----------
	14203	trivial	Koha-translate error string for non-existent lang removal

Database
----------
	14350	minor	Missing statement in kohastructure.sql - DROP TABLE IF EXISTS borrower_sync;

Hold requests
----------
	14142	minor	Holds queue viewer only displays first subtitle from marc keyword mappings

I18N/L10N
----------
	13656	normal	"Change"/"Set to patron" button for linking a member to an organisation (or child to guarantor) not translatable
	14263	normal	Export of CSV from item search form does only work in English

Notices
----------
	14206	normal	Notices using non email templates can't be deleted from the staff client

OPAC
----------
	14173	normal	Paging on 'recent comments' page in OPAC is not displaying correctly
	14313	normal	OPAC: Adding a comment makes result browser disappear
	14025	minor	Fix 856u-links in the OPAC for NORMARC
	14184	minor	Noisy warns in C4/CourseReserves.pm
	14185	minor	Noisy warns in opac-readingrecord.pl
	14186	minor	Noisy warns in opac-reserve.pl
	14269	minor	OPAC: Small template improvements to full serial history page

Patrons
----------
	9314	normal	Remove useless code related to the type_only parameter
	13970	normal	Remove related code to category_type
	14338	normal	Unable to delete patron images
	11929	minor	Patron modification error shows borrowernumber
	11941	minor	"Patron lists" are not easily accessible

Reports
----------
	14130	normal	Column.def should be updated with descriptions for new columns

Serials
----------
	13662	normal	Serial permissions: receive_serials

System Administration
----------
	14291	minor	OpacExportOptions shouldn't say 'separated by |'
	14314	trivial	System Preferences: Better explanation for syspref 'ShowReviewerPhoto'

Templates
----------
	14265	normal	Use $.trim instead of trim() in admin/categorie.tt
	14266	normal	Replace trim() with $.trim() in opac-shareshelf.tt
	14279	normal	Remove CGI::scrolling_list from issues_avg_stats.pl
	12176	minor	Remove HTML from additem.pl
	13946	minor	Change order status 'Pending' to ordered like in database
	14267	minor	How active is active in additem.tt?
	14275	minor	Remove CGI::scrolling_list from guided_reports.pl
	14329	trivial	Useless copy/paste from Template::Plugin::HtmlToText
	14330	trivial	Remove unused email_sender from sendbasket/sendshelf

Test Suite
----------
	14256	normal	Tests for TestBuilder fail randomly
	14112	minor	Silence warnings t/Charset.t

Tools
----------
	10355	minor	Second click on modification log misses object parameter

translate.koha-community.org
----------
	14285	trivial	Bengali locale needs to be re-defined


New sysprefs in 3.20.1
======================



System requirements
======================

    Important notes:
    
    * Perl 5.10 is required
    * Zebra is required


Documentation
======================

The Koha manual is maintained in DocBook.The home page for Koha 
documentation is 

    http://koha-community.org/documentation/

As of the date of these release notes, only the English version of the
Koha manual is available:

    http://manual.koha-community.org/3.20/en/

The Git repository for the Koha manual can be found at

    http://git.koha-community.org/gitweb/?p=kohadocs.git;a=summary


Translations
======================

Complete or near-complete translations of the OPAC and staff
interface are available in this release for the following languages:


  * English (USA)


Partial translations are available for various other languages.

The Koha team welcomes additional translations; please see

    http://wiki.koha-community.org/wiki/Translating_Koha

for information about translating Koha, and join the koha-translate 
list to volunteer:

    http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate

The most up-to-date translations can be found at:

    http://translate.koha-community.org/


Release Team
======================

The release team for Koha 3.20.1 is

  Release Manager:       Tomás Cohen Arazi <tomascohen@gmail.com>
  QA Manager:            Katrin Fischer <Katrin.Fischer@bsz-bw.de>
  Documentation Manager: Nicole C. Engard <nengard@gmail.com>
  Translation Manager:   Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
  QA Team:               Jonathan Druart <jonathan.druart@biblibre.com>
                         Brendan Gallagher <brendan@bywatersolutions.com>
                         Kyle Hall <kyle@bywatersolutions.com>
                         Paul Poulain <paul.poulain@biblibre.com>
                         Martin Renvoize <martin.renvoize@ptfs-europe.com>
                         Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
  Bug Wrangler:          Magnus Enger <magnus@enger.priv.no>
  Packaging Manager:     Robin Sheat <robin@catalyst.net.nz>

  Release Maintainer (3.18.x): Chris Cormack <chrisc@catalyst.net.nz>
  Release Maintainer (3.16.x): Mason James <mtj@kohaaloha.com>
  Release Maintainer (3.14.x): Fridolin Somers <fridolin.somers@biblibre.com>

Credits
======================


We thank the following libraries who are known to have sponsored
new features in Koha 3.20.1:

We thank the following individuals who contributed patches to Koha 3.20.1.

  * Aleisha (5)
  * Nicole C. Engard (1)
  * Tomás Cohen Arazi (3)
  * David Cook (2)
  * Chris Cormack (16)
  * Indranil Das Gupta (4)
  * Marcel de Rooy (8)
  * Jonathan Druart (18)
  * Magnus Enger (1)
  * Katrin Fischer (5)
  * Bernardo González Kriegel (6)
  * Kyle M Hall (4)
  * Josef Moravec (1)
  * Dobrica Pavlinusic (1)
  * Zeno Tajoli (1)
  * Mark Tompsett (4)
  * Marc Véron (3)


We thank the following libraries, companies, and other institutions who contributed
patches to Koha 3.20.1


  * BSZ BW (5)
  * BibLibre (9)
  * ByWater-Solutions (5)
  * Catalyst (16)
  * Cineca (1)
  * Libriotech (1)
  * Prosentient Systems (2)
  * Rijksmuseum (8)
  * Universidad Nacional de Córdoba (6)
  * koha-community.org (9)
  * rot13.org (1)
  * theke.io (3)
  * unidentified (14)
  * veron.ch (3)

We also especially thank the following individuals who tested patches
for Koha 3.20.1.

  * Aleisha (1)
  * Brendan Gallagher (1)
  * Cédric Vita (1)
  * Chris Cormack (78)
  * Frederic Demians (1)
  * Gaetan Boisson (1)
  * Jonathan Druart (46)
  * Katrin Fischer (36)
  * Liz Rea (1)
  * Marc Veron (1)
  * Marc Véron (9)
  * Mark Tompsett (7)
  * Nick Clemens (1)
  * Paola Rossi (1)
  * Signed-off-by:Heather Braum (1)
  * Tomas Cohen Arazi (74)
  * Indranil Das Gupta (2)
  * Indranil Das Gupta (L2C2 Technologies) (8)
  * Kyle M Hall (13)
  * Bernardo Gonzalez Kriegel (17)
  * Marcel de Rooy (11)

We regret any omissions.  If a contributor has been inadvertently missed,
please send a patch against these release notes to 
koha-patches@lists.koha-community.org.

Revision control notes
======================

The Koha project uses Git for version control.  The current development 
version of Koha can be retrieved by checking out the master branch of 

    git://git.koha-community.org/koha.git

The branch for this version of Koha and future bugfixes in this release line is 3.20.x.

The last Koha release was 3.16.9, which was released on March 29, 2015.


Bugs and feature requests
======================

Bug reports and feature requests can be filed at the Koha bug
tracker at

    http://bugs.koha-community.org/


He rau ringa e oti ai.
(Many hands finish the work)

##### Autogenerated release notes updated last on 23 Jun 2015 07:28:54 Z #####
Posted in 3.20