March 2022 - Koha-bugs - lists.koha-community.org

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132111|0 |1 is obsolete| | --- Comment #97 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 132115 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132115&action=e… Bug 29957: Add example lines in koha-conf.xml Test plan: Just comments. Nothing to test. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Amended: using new name for deny list. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29915] Anonymous session generates 1 new session ID per hit
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29915 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #132104|0 |1 is obsolete| | --- Comment #122 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 132114 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132114&action=e… Bug 29915: Prevent bad cookie from corrupted session If there is deleted session info but no session->id, a wrong cookie with empty name could be generated containing expired session id. Test plan: Run t/db_dependent/Auth.t Login. Check cookies in browser. Logout. Check cookies in browser. Without this patch, you should see an invalid cookie. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #96 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #82) > (In reply to Jonathan Druart from comment #81) > > (In reply to Jonathan Druart from comment #80) > > > (In reply to Marcel de Rooy from comment #79) > > > > Out of scope here? But why not support passing the language too in the URL > > > > parameter of opac-main? Save as favorite, and you are done. > > > > > > This is implemented already, you can pass &language=es-ES > > > > Sorry, misread. Ignore that. > > Or maybe not, well, it's implemented if it's what you need. I now chose to add KohaOpacLanguage as a default exception to clearing at logout. But it will only apply to new installs. Would it be useful in the release notes text too as a workaround? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #95 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Tested now on top of last additional fix on bug 29915 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131856|0 |1 is obsolete| | --- Comment #94 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 132111 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132111&action=e… Bug 29957: Add example lines in koha-conf.xml Test plan: Just comments. Nothing to test. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Amended: using new name for deny list. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131843|0 |1 is obsolete| | --- Comment #93 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 132110 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132110&action=e… Bug 29957: Let check_api_auth return created cookie The cookie created on L1496 is useless, since it is not returned. We could either remove the cookie creation (unchanged behavior). But since check_api_auth is expected to return a cookie when it is ok, I opt for returning the cookie here (corrected behavior). Test plan: Logout in staff. Check on staff: /cgi-bin/koha/svc/localization?id=1 You should have a 400 response. Login with staff credentials (incl. manage_itemtypes) Revisit same URL. You should see a JSON response. Check if you can hit other staff pages. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 24 Mar '22

24 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131842|0 |1 is obsolete| | --- Comment #92 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 132109 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132109&action=e… Bug 29957: Adjust push @$cookie statements in Auth We can now use $cookie_mgr->replace_in_list instead. This effectively removes duplicates and keeps the newest cookie. Note: In the test plan below we are just verifying if this patch did not change behavior. The replace_in_list routine has been tested already in a unit test. Test plan: Run t/db_dependent/Auth.t Login at OPAC. Hit some opac and staff pages. Perform an Advanced search on OPAC. Check cookies in browser. Logout. Check cookies again. Verify with your do_not_remove_cookie lines in koha-conf.xml. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0