New subject: [Bug 43805] Logging back in after a session timeout 404s on Vue pages served through a RewriteRule (record_sources, circulation_triggers)

14 Oct 2026

      https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43805

            Bug ID: 43805
           Summary: Logging back in after a session timeout 404s on Vue
                    pages served through a RewriteRule (record_sources,
                    circulation_triggers)
   Initiative type: ---
        Sponsorship ---
            status:
           Product: Koha
           Version: Main
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5 - low
         Component: Architecture, internals, and plumbing
          Assignee: koha-bugs@lists.koha-community.org
          Reporter: martin.renvoize@openfifth.co.uk
        QA Contact: testopia@bugs.koha-community.org
  Target Milestone: ---

Staff interface pages that are served through a RewriteRule of the form

  RewriteRule ^/cgi-bin/koha/admin/record_sources(.*)?$
/cgi-bin/koha/admin/record_sources.pl$1 [PT]

(etc/koha-httpd.conf and debian/templates/apache-shared-intranet.conf; the same
shape is used for admin/circulation_triggers) cannot be logged back in to after
the session times out.

The pattern also matches the script's own name, so a request for
record_sources.pl is rewritten to record_sources.pl.pl and returns 404. When
the login form is shown on such a page, its action is the script name
(/cgi-bin/koha/admin/record_sources.pl). Submitting it therefore 404s, no
session is created, and the user is stuck on an error page until they log in
through another page (for example mainpage.pl) and navigate back.

To reproduce (main, 26.06.00.035, in KTD):
1. Log out (or let the session expire).
2. Open /cgi-bin/koha/admin/record_sources. The login page is shown; its form
action is /cgi-bin/koha/admin/record_sources.pl.
3. Enter valid credentials and submit.

Expected: you are logged in and see the record sources page.
Actual: "Error 404 > Koha". No session is created.

Evidence with curl (cookie jar, valid csrf_token taken from the login page):
- POST to the form action /cgi-bin/koha/admin/record_sources.pl  -> 404
- POST of the same fields to /cgi-bin/koha/admin/record_sources   -> 200
GET /cgi-bin/koha/admin/record_sources.pl and
/cgi-bin/koha/admin/circulation_triggers.pl also return 404.

Not affected: acquisition/vendors, whose rule maps acquisition/vendors to
acqui/vendors.pl, so acqui/vendors.pl is reachable (200).

Found while building a new Vue page under Cataloguing (bug 30800), which copies
the same rule and so has the same problem.

Possible directions (not verified):
- Guard the rules so the script's own name is not rewritten, as is already done
for preservation in the same file:
    RewriteCond %{REQUEST_URI} !^/cgi-bin/koha/preservation/.*.pl$
  A similar RewriteCond for each of these pages would let the .pl URL reach the
script. The Vue router base paths are the extensionless URLs, so it needs
checking what the app does when it is loaded on the .pl URL after login.
- Or have the login form post back to the URL the user actually requested
instead of the script name when the request was rewritten.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.

[Bug 43805] New: Logging back in after a session timeout 404s on Vue pages served through a RewriteRule (record_sources, circulation_triggers)

bugzilla-daemon＠bugs.koha-community.org

bugzilla-daemon＠bugs.koha-community.org

bugzilla-daemon＠bugs.koha-community.org

bugzilla-daemon＠bugs.koha-community.org

bugzilla-daemon＠bugs.koha-community.org

bugzilla-daemon＠bugs.koha-community.org

tags

participants (1)