http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|3.10 |master --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- Confirmed in master. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 --- Comment #3 from Galen Charlton <gmcharlt@gmail.com> --- (In reply to Galen Charlton from comment #2)

Telling the browser not to cache self-check pages should resolve this

It does already use a no-cache Cache-control directive; some preliminary testing indicates that adding max-age=0 to the cache-control directive should do it. Working on a patch. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 --- Comment #4 from Galen Charlton <gmcharlt@gmail.com> --- Created attachment 22115 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22115&action=edit bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 --- Comment #6 from Galen Charlton <gmcharlt@gmail.com> --- Created attachment 22117 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22117&action=edit bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 Ed Veal <ed.veal@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #22116|0 |1 is obsolete| | Attachment #22117|0 |1 is obsolete| | --- Comment #8 from Galen Charlton <gmcharlt@gmail.com> --- Created attachment 22126 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22126&action=edit Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 --- Comment #10 from Ed Veal <ed.veal@bywatersolutions.com> --- Created attachment 22129 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22129&action=edit [SIGN-OFF]bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 Ed Veal <ed.veal@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #22126|0 |1 is obsolete| | Attachment #22127|0 |1 is obsolete| | Attachment #22129|0 |1 is obsolete| | --- Comment #11 from Ed Veal <ed.veal@bywatersolutions.com> --- Created attachment 22130 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22130&action=edit Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 --- Comment #13 from Ed Veal <ed.veal@bywatersolutions.com> --- Created attachment 22132 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22132&action=edit [SIGN-OFF]bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 --- Comment #15 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 22141 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22141&action=edit [PASSED-QA] bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10016 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #16 from Galen Charlton <gmcharlt@gmail.com> --- Pushed to master. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.