March 2022 - Koha-bugs - lists.koha-community.org

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #123 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- First QA of HackFest 22! Whilst I'm still not sure about the need for such a list in config, it is great to see some of this stuff factored out into it's own module and it gives us a great foundation going forward. I'd love to see a 'Private computer' checkbox on login screens next and have a list of cookies to keep should that checkbox be ticked at login vs a completely public computer where I still think we should remove all by default. So, given that statement, this is looking good. Tests are passing, QA scripts are happy and I can't find any regressions.. PQA, great teamwork. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132239|0 |1 is obsolete| | --- Comment #122 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132296 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132296&action=e… Bug 29957: (follow-up) correct spelling QA complaint Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132238|0 |1 is obsolete| | --- Comment #121 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132295 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132295&action=e… Bug 29957: Add --keep-cookie option to koha-create As requested on comment99. Personally I do not feel that it should be a requirement for adding a koha-conf entry though. Note that koha-create does/did not even support adding multiple line entries to koha-conf like we do here now. But it might be a start for adding them? Test plan: The following tweak might help you to test without running the complete koha-create, while still convincing you: [1] cp debian/templates/koha-conf-site.xml.in /etc/koha/test.conf [2] Add the following line in debian/scripts/koha-create. Append if after the BCRYPT_SETTINGS= line on L652: generate_config_file test.conf test.xml; exit [3] Run debian/scripts/koha-create --keep-cookie A [4] Check if you see <do_not_remove_cookie>A<..> in test.xml. [5] Run debian/scripts/koha-create --keep-cookie A --keep-cookie B [6] Check for two lines in test.xml [7] Run debian/scripts/koha-create clone_name [8] Check that the __KEEP_COOKIE__ line is gone in test.xml. [9] Undo the tweak by removing test.xml and /etc/koha/test.conf, and removing the added line from koha-create. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132237|0 |1 is obsolete| | --- Comment #120 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132294 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132294&action=e… Bug 29957: Add example lines in koha-conf.xml Test plan: Just comments. Nothing to test. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Amended: using new name for deny list. Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132236|0 |1 is obsolete| | --- Comment #119 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132293 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132293&action=e… Bug 29957: Let check_api_auth return created cookie The cookie created on L1496 is useless, since it is not returned. We could either remove the cookie creation (unchanged behavior). But since check_api_auth is expected to return a cookie when it is ok, I opt for returning the cookie here (corrected behavior). Test plan: Logout in staff. Check on staff: /cgi-bin/koha/svc/localization?id=1 You should have a 400 response. Login with staff credentials (incl. manage_itemtypes) Revisit same URL. You should see a JSON response. Check if you can hit other staff pages. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132235|0 |1 is obsolete| | --- Comment #118 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132292 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132292&action=e… Bug 29957: Adjust push @$cookie statements in Auth We can now use $cookie_mgr->replace_in_list instead. This effectively removes duplicates and keeps the newest cookie. Note: In the test plan below we are just verifying if this patch did not change behavior. The replace_in_list routine has been tested already in a unit test. Test plan: Run t/db_dependent/Auth.t Login at OPAC. Hit some opac and staff pages. Perform an Advanced search on OPAC. Check cookies in browser. Logout. Check cookies again. Verify with your do_not_remove_cookie lines in koha-conf.xml. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132234|0 |1 is obsolete| | --- Comment #117 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132291 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132291&action=e… Bug 29957: Replace clear_all_cookies in Auth.pm Test plan: Enable language selection and have two languages. Change language. Check cookie value in browser for KohaOpacLanguage. Logout. Verify that cookie has been cleared in browser. Add do_not_remove_cookie line for KohaOpacLanguage in koha-conf. Restart, flush. Login again. Change language. Check cookie value in browser for KohaOpacLanguage. Logout. Verify that cookie still contains the language. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132233|0 |1 is obsolete| | --- Comment #116 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132290 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132290&action=e… Bug 29957: (follow-up) Turn allow list into deny list See the discussion on the Bugzilla report. It might be easier to work with a deny list. Test plan: Run t/CookieManager.t Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132232|0 |1 is obsolete| | --- Comment #115 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132289 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132289&action=e… Bug 29957: Introduce Koha::CookieManager Test plan: Run t/CookieManager.t Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 28 Mar '22

28 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132231|0 |1 is obsolete| | --- Comment #114 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 132288 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132288&action=e… Bug 29957: Clear cookies on logout Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Amended: Reverted the change to $cookies to minimize changes. Fixed Auth.t where checkauth is being mocked. Signed-off-by: Nick Clemens <nick(a)bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0