https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Bug ID: 38258 Summary: Connecting to koha without the proper CGI cookie can disconnect every session Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: baptiste.wojtkowski@biblibre.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org To reproduce : 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected I'm not sure about the exact mechanism leading to a disconnection, but this is due to :
check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. This is true for all the results of:
git grep "check_cookie_auth.*cookie.*CGISESSID"
-- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.