https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43805 Bug ID: 43805 Summary: Logging back in after a session timeout 404s on Vue pages served through a RewriteRule (record_sources, circulation_triggers) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@openfifth.co.uk QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Staff interface pages that are served through a RewriteRule of the form RewriteRule ^/cgi-bin/koha/admin/record_sources(.*)?$ /cgi-bin/koha/admin/record_sources.pl$1 [PT] (etc/koha-httpd.conf and debian/templates/apache-shared-intranet.conf; the same shape is used for admin/circulation_triggers) cannot be logged back in to after the session times out. The pattern also matches the script's own name, so a request for record_sources.pl is rewritten to record_sources.pl.pl and returns 404. When the login form is shown on such a page, its action is the script name (/cgi-bin/koha/admin/record_sources.pl). Submitting it therefore 404s, no session is created, and the user is stuck on an error page until they log in through another page (for example mainpage.pl) and navigate back. To reproduce (main, 26.06.00.035, in KTD): 1. Log out (or let the session expire). 2. Open /cgi-bin/koha/admin/record_sources. The login page is shown; its form action is /cgi-bin/koha/admin/record_sources.pl. 3. Enter valid credentials and submit. Expected: you are logged in and see the record sources page. Actual: "Error 404 > Koha". No session is created. Evidence with curl (cookie jar, valid csrf_token taken from the login page): - POST to the form action /cgi-bin/koha/admin/record_sources.pl -> 404 - POST of the same fields to /cgi-bin/koha/admin/record_sources -> 200 GET /cgi-bin/koha/admin/record_sources.pl and /cgi-bin/koha/admin/circulation_triggers.pl also return 404. Not affected: acquisition/vendors, whose rule maps acquisition/vendors to acqui/vendors.pl, so acqui/vendors.pl is reachable (200). Found while building a new Vue page under Cataloguing (bug 30800), which copies the same rule and so has the same problem. Possible directions (not verified): - Guard the rules so the script's own name is not rewritten, as is already done for preservation in the same file: RewriteCond %{REQUEST_URI} !^/cgi-bin/koha/preservation/.*.pl$ A similar RewriteCond for each of these pages would let the .pl URL reach the script. The Vue router base paths are the extensionless URLs, so it needs checking what the app does when it is loaded on the .pl URL after login. - Or have the login form post back to the URL the user actually requested instead of the script name when the request was rewritten. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.