March 2022 - Koha-bugs - lists.koha-community.org

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131828|0 |1 is obsolete| | --- Comment #71 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131843 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131843&action=e… Bug 29957: Let check_api_auth return created cookie The cookie created on L1496 is useless, since it is not returned. We could either remove the cookie creation (unchanged behavior). But since check_api_auth is expected to return a cookie when it is ok, I opt for returning the cookie here (corrected behavior). Test plan: Logout in staff. Check on staff: /cgi-bin/koha/svc/localization?id=1 You should have a 400 response. Login with staff credentials (incl. manage_itemtypes) Revisit same URL. You should see a JSON response. Check if you can hit other staff pages. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131827|0 |1 is obsolete| | --- Comment #70 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131842 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131842&action=e… Bug 29957: Adjust push @$cookie statements in Auth We can now use $cookie_mgr->replace_in_list instead. This effectively removes duplicates and keeps the newest cookie. Test plan: Run t/db_dependent/Auth.t Add removable_cookie entries in koha-conf for: form_serialized, form_serialized_limits (Note: these are js cookies, no httponly flag.) Login at OPAC. If you are using the same domain, check if you are logged in on the staff client too. Go back to OPAC, perform an Advanced search. Check cookies on browser dev console. Look for the 2 form_ cookies. Go to staff. Logout Go to OPAC. Check cookies in dev console. Are you logged out? Login at staff again. Hit some pages in the staff client and verify that they respond as expected. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131826|0 |1 is obsolete| | --- Comment #69 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131841 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131841&action=e… Bug 29957: Replace clear_all_cookies in Auth.pm Test plan: Enable language selection and have two languages. Add removable_cookie line for KohaOpacLanguage in koha-conf. Restart, flush. Login, logout from opac or staff. Check in browser dev console that value of this cookie is cleared, noting that the httponly flag has been unset. Remove the added line in koha-conf. Restart, flush. Login. Change language. Logout. Check if cookie is preserved. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131825|0 |1 is obsolete| | --- Comment #68 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 131840 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131840&action=e… Bug 29957: Introduce Koha::CookieManager Test plan: Run t/CookieManager.t Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 27887] New: Patrons should not receive overdue notices for claimed returns
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27887 Bug ID: 27887 Summary: Patrons should not receive overdue notices for claimed returns Change sponsored?: --- Product: Koha Version: 19.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: estherm(a)sodaspringsid.com QA Contact: testopia(a)bugs.koha-community.org Patrons who have claimed returns items continue to receive overdue notices. This is problematic especially if the claim is they really did return the item or never had it. These patrons should not continue to receive overdue notices. There is currently not a way to exclude claimed returns from overdue notices. It would be nice to have a system setting or some other way to prevent overdue notices from going out on those items. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 30305] New: CookieManager: add logic for HttpOnly flag
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30305 Bug ID: 30305 Summary: CookieManager: add logic for HttpOnly flag Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org Follow-up report of 29957 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #67 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Owen Leonard from comment #66) > Does this affect Bug 26019 (besides creating understandable conflicts) ? Conflicts, sure. And we definitely dont like rebase trouble in Auth :) So they need some careful rebasing, especially since there is more Auth in the pipeline. Not much more than that. I would be tempted to move the SameSite attribute to CookieManager in the future and perhaps syspref it. But thats just ideas. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #66 from Owen Leonard <oleonard(a)myacpl.org> --- Does this affect Bug 26019 (besides creating understandable conflicts) ? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #65 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- The last patch deals with this funny code part in check_api_auth: my $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), ); return ( $return, undef, $session ); This is useless code. In this statement we can simply return the created $cookie instead. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 17 Mar '22

17 Mar '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 --- Comment #64 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #58) > > Further development on this front should be master only. Could go to another > report. The fourth commit message shows you an example of it: differentiate > between HttpOnly yes or no. > What do you think? I decided to fix the httponly issue when clearing cookies here by simply removing the flag for the temporary cleared cookie. -- You are receiving this mail because: You are watching all bug changes.

1 0