Evergreen ILS

Open Source Library Software

Galen Charlton

Evergreen and OpenSRF Security Releases: Evergreen 3.10.5, 3.11.6, 3.12.4, 3.13.1; OpenSRF 3.2.5 and 3.3.1

The Evergreen Project announces security releases for Evergreen and OpenSRF.

The Evergreen releases are:

  • 3.10.5
  • 3.11.6
  • 3.12.4
  • 3.13.1

The Evergreen releases include fixes for the following issues:

  • Two reflected XSS (cross-site scripting) vulnerabilities that would permit allowing executing arbitrary JavaScript by the user’s web browser
  • An insecure direct object reference (IDOR) vulnerability that allows for constructing URLs that can access arbitrary Action Trigger event output, including data related to patron circulation notices

The IDOR vulnerability is considered critical; all Evergreen sites are recommended to upgrade or apply the fixes as soon as possible.

The OpenSRF releases are:

  • 3.2.5
  • 3.3.1

The OpenSRF releases fix a buffer overflow and a race condition that can crash Perl services. There are no known exploits for either issue, but Evergreen sites are nonetheless recommended to upgrade OpenSRF.

Additional information, including the new releases and release notes with instructions for applying the fixes, can be found on the downloads pages for Evergreen and OpenSRF.

Evergreen API Deprecation Notice: Several Disused Methods for Holds

The following Evergreen API methods will be deprecated:

  • open-ils.circ.holds.create
  • open-ils.circ.holds.create.override
  • open-ils.circ.holds.create.batch
  • open-ils.circ.holds.create.override.batch

The deprecation will occur in two phases:

  • Evergreen 3.13: formal deprecation. Evergreen will warn about use of these APIs in its logs.
  • The major Evergreen release that follows 3.13: removal of the methods

Any applications using the deprecated APIs should instead use the methods “open-ils.circ.holds.test_and_create.batch” and/or “open-ils.circ.holds.test_and_create.batch.override”. This switch can and should be made at any time; it need not wait on the formal deprecation.

For assistance with updating your application, please feel free to raise questions on the evergreen-dev mailing list or on the #evergreen IRC channel.

Additional information and discussion about this deprecation can be found in bug 1017990.

This announcement supersedes a previous, retracted announcement that incorrectly stated that “open-ils.circ.title_hold.is_possible” will be deprecated. That method will NOT be deprecated

-Evergreen community

Evergreen 3.11-beta Released

The Evergreen Community is pleased to announce the beta release for Evergreen 3.11. This beta release marks one more step towards the release of 3.11.0, a major release with numerous new features. Everyone is encouraged to test this beta and report any issues on the Launchpad bug tracker so that we can make 3.11.0 the best that it can be!

Highlights of 3.11 include:

  • Queued Ingest functionality that improves the management of catalog record indexing
  • A new catalog record staff view tab in the Angular staff interface
  • Extending the “Did You Mean” functionality to cover multi-word, single class searches. In addition, search suggestions can now be triggered when the patron uses a non-preferred term that is present in an authority record.
  • A new test dataset called “Enhanced Concerto”
  • A new permission for updating patron barcodes
  • The new ability to define automatically-applied custom standing penalties
  • Improvements to the user interface for placing holds on titles that have monograph parts
  • An upgrade of the Angular staff interface to Angular 15 and Bootstrap 5
  • Numerous accessibility improvements

A list of the bugfixes and enhancements in the beta is available here. Full release notes will be published no later than upon release of 3.11.0.

The Evergreen Community wishes to thank all those who contributed code, testing, documentation and their time to this release.

Full information is available on the Evergreen downloads page.

On behalf of the 3.11 release team:

  • Michele Morgan
  • Jason Boyer
  • Blake Graham-Henderson