March 2022 - Koha-bugs - lists.koha-community.org

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #67 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Owen Leonard from comment #66) > Does this affect Bug 26019 (besides creating understandable conflicts) ? Conflicts, sure. And we definitely dont like rebase trouble in Auth :) So they need some careful rebasing, especially since there is more Auth in the pipeline. Not much more than that. I would be tempted to move the SameSite attribute to CookieManager in the future and perhaps syspref it. But thats just ideas. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #66 from Owen Leonard <oleonard(a)myacpl.org> --- Does this affect Bug 26019 (besides creating understandable conflicts) ? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #65 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- The last patch deals with this funny code part in check_api_auth: my $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), ); return ( $return, undef, $session ); This is useless code. In this statement we can simply return the created $cookie instead. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #64 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #58) > > Further development on this front should be master only. Could go to another > report. The fourth commit message shows you an example of it: differentiate > between HttpOnly yes or no. > What do you think? I decided to fix the httponly issue when clearing cookies here by simply removing the flag for the temporary cleared cookie. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #63 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131828 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131828&action=e… Bug 29957: Let check_api_auth return created cookie The cookie created on L1496 is useless, since it is not returned. We could either remove the cookie creation (unchanged behavior). But since check_api_auth is expected to return a cookie when it is ok, I opt for returning the cookie here (corrected behavior). Test plan: Logout in staff. Check on staff: /cgi-bin/koha/svc/localization?id=1 You should have a 400 response. Login with staff credentials (incl. manage_itemtypes) Revisit same URL. You should see a JSON response. Check if you can hit other staff pages. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131810|0 |1 is obsolete| | --- Comment #62 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131827 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131827&action=e… Bug 29957: Adjust push @$cookie statements in Auth We can now use $cookie_mgr->replace_in_list instead. This effectively removes duplicates and keeps the newest cookie. Test plan: Run t/db_dependent/Auth.t Add removable_cookie entries in koha-conf for: form_serialized, form_serialized_limits (Note: these are js cookies, no httponly flag.) Login at OPAC. If you are using the same domain, check if you are logged in on the staff client too. Go back to OPAC, perform an Advanced search. Check cookies on browser dev console. Look for the 2 form_ cookies. Go to staff. Logout Go to OPAC. Check cookies in dev console. Are you logged out? Login at staff again. Hit some pages in the staff client and verify that they respond as expected. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131809|0 |1 is obsolete| | --- Comment #61 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131826 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131826&action=e… Bug 29957: Replace clear_all_cookies in Auth.pm Test plan: Enable language selection and have two languages. Add removable_cookie line for KohaOpacLanguage in koha-conf. Restart, flush. Login, logout from opac or staff. Check in browser dev console that value of this cookie is cleared, noting that the httponly flag has been unset. Remove the added line in koha-conf. Restart, flush. Login. Change language. Logout. Check if cookie is preserved. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131808|0 |1 is obsolete| | --- Comment #60 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131825 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131825&action=e… Bug 29957: Introduce Koha::CookieManager Test plan: Run t/CookieManager.t Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131807|0 |1 is obsolete| | --- Comment #59 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131824 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131824&action=e… Bug 29957: Clear cookies on logout Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> Amended: Reverted the change to $cookies to minimize changes. Fixed Auth.t where checkauth is being mocked. -- You are receiving this mail because: You are watching all bug changes.

1 0