[Bug 36586] New: Self-checkouts will get CSRF errors if left inactive for 8 hours
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Bug ID: 36586 Summary: Self-checkouts will get CSRF errors if left inactive for 8 hours Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Self checkout Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Currently, the CSRF token is only good for 8 hours. This means that a self-checkout terminal left inactive for 8 hours (e.g. overnight, over a holiday closure, etc) will create a wrong CSRF token error on the first activity attempt in the morning. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- I think the most obvious (but not necessarily the best) solution is to have a timer that refreshes the main SCO page at certain intervals. -- (Note that this same problem will probably arise with Vue.js driven pages.) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Dave <ddaghita@mckinneytexas.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ddaghita@mckinneytexas.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=38327 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #2 from Jonathan Druart <jonathan.druart@gmail.com> --- SCI has a SelfCheckInTimeout pref that refreshes the screen. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #2)
SCI has a SelfCheckInTimeout pref that refreshes the screen.
That should do the trick. We could move that out to a .js file and use it in both interfaces. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #4 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 175210 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175210&action=edit Bug 36586: WIP This patch moves the refresh code into a js include and sets a few variables in the page. It also moves the fetch of the pref into the template. We need to copy this over for the sco - and probably add a new pref. Lastly, the code here only refreshes during an active session, probably we could have a single pref SelfCheckRefresh that would trigger on the main page, default to 3 or 4 hours? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- (In reply to Nick Clemens (kidclamp) from comment #4)
This patch moves the refresh code into a js include and sets a few variables in the page.
Did you write the JS file? It's not appearing in the patch.
Lastly, the code here only refreshes during an active session, probably we could have a single pref SelfCheckRefresh that would trigger on the main page, default to 3 or 4 hours?
As in, the current timeout is just an activity timeout to log them out? Yeah, I think a timer on the main page that defaults to even 1 time per hour would be good. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #175210|0 |1 is obsolete| | --- Comment #6 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 175239 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175239&action=edit Bug 36586: WIP This patch moves the refresh code into a js include and sets a few variables in the page. It also moves the fetch of the pref into the template. We need to copy this over for the sco - and probably add a new pref. Lastly, the code here only refreshes during an active session, probably we could have a single pref SelfCheckRefresh that would trigger on the main page, default to 3 or 4 hours? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #7 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to David Cook from comment #5)
(In reply to Nick Clemens (kidclamp) from comment #4) Did you write the JS file? It's not appearing in the patch.
heh, "git commit -a", but didn't add the new file ;-) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- Comment on attachment 175239 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175239 Bug 36586: WIP Review of attachment 175239: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=36586&attachment=175239) ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt @@ +274,4 @@
});
+ let idleTimeout = [% Koha.Preference('SelfCheckInTimeOut') || 120 %];
There's a filter missing here. I noticed with the eyeballs and QA tools says it as well. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- (In reply to Nick Clemens (kidclamp) from comment #7)
heh, "git commit -a", but didn't add the new file ;-)
I've been writing a lot of new code on a different project, and I feel this pain haha -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- This WIP looks like it works for the existing functionality. But since we want timers for the borrower session and the SCO/SCI session, I'm thinking we should encapsulate the timers in objects. We'd create 2 objects, and then feed them their respective timer thresholds. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com --- Comment #11 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to David Cook from comment #10)
This WIP looks like it works for the existing functionality.
But since we want timers for the borrower session and the SCO/SCI session, I'm thinking we should encapsulate the timers in objects. We'd create 2 objects, and then feed them their respective timer thresholds.
I don't think I am quite sure what you mean here, JS objects? Koha Objects? Can you help with a patch or some pseudo code? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- (In reply to Nick Clemens (kidclamp) from comment #11)
(In reply to David Cook from comment #10)
This WIP looks like it works for the existing functionality.
But since we want timers for the borrower session and the SCO/SCI session, I'm thinking we should encapsulate the timers in objects. We'd create 2 objects, and then feed them their respective timer thresholds.
I don't think I am quite sure what you mean here, JS objects? Koha Objects? Can you help with a patch or some pseudo code?
Ah my bad. Yeah, JS objects. Sure, I'll look at doing a quick patch. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #13 from David Cook <dcook@prosentient.com.au> --- Created attachment 175919 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175919&action=edit Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #14 from David Cook <dcook@prosentient.com.au> --- So the Javascript class here allows us to create multiple objects with the same code, so we can have the "window.sci_login_timer" which just governs the login timeout. But then we could easily create another timer for however many hours we want. (For that scenario, perhaps we'd actually want to set a higher interval than 1 second, and instead maybe check every minute or X minutes. Anyway, that's what I had in mind. I wrote it without jQuery, and I tweaked the conditions a bit, so that we're only invoking the timer where we need it in the first place rather than running it and checking for the button visibility on each increment. -- Also added in the missing TT filter and wrapper the idleTimeout in double quotes to avoid XSS. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com --- Comment #15 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Hey David, is this ready for testing? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #16 from David Cook <dcook@prosentient.com.au> --- (In reply to Lucas Gass (lukeg) from comment #15)
Hey David, is this ready for testing?
Mmm... I think it could be tested, but really someone (myself or someone else) needs to add it for the SCO too. The "login_timeout" function could actually get moved to timeout.js too. At the moment, I'm just making an exception to CSRF for self-checks, so this hasn't been a priority for me. And actually... looking at this again... I think we've just refactored what's already there? I think this just redirects to the sci-main.pl after an inactivity timeout under some conditions. I don't think it would prevent the CSRF issue... So yeah... no not ready for testing, alas. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #175239|0 |1 is obsolete| | Attachment #175919|0 |1 is obsolete| | --- Comment #17 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 181645 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181645&action=edit Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #18 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 181646 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181646&action=edit Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181645|0 |1 is obsolete| | --- Comment #19 from David Nind <david@davidnind.com> --- Created attachment 181694 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181694&action=edit Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181646|0 |1 is obsolete| | --- Comment #20 from David Nind <david@davidnind.com> --- Created attachment 181695 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181695&action=edit Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #21 from David Nind <david@davidnind.com> --- The thing I most noticed after the patches is that: 1. The self check-in page visible refreshes every 5 seconds. 2. The self check-out login page visible refreshes every 5 seconds. Before the patches, this did not happen. Testing notes (using KTD) ======================== Self check-in ------------- Self check-in (not enabled by default in KTD): 0. Enable the SelfCheckInModule system preference 1. Set SelfCheckinTimeout system preference to 5 2. http://127.0.0.1:8080/cgi-bin/koha/sci/sci-main.pl 3. Log in as the koha user (the password is koha) Before the patch: - you are logged out after 5 seconds - the self check-in page doesn't auto-refresh After the patch: - you are logged out after 5 seconds - self check-in page refreshes every 5 seconds (or the refresh is not visible) - the page doesn't refresh if you are typing in a barcode slowly Self check-out -------------- Self check-out (enabled by default in KTD): 1. Set SelfCheckTimout system preference to 5 2. URL: 127.0.0.1:8080/cgi-bin/koha/sco/sco-main.pl 3. Log in as the koha user (the password is koha) Before the patch: - you are logged out after 5 seconds - the self check-in page doesn't auto-refresh (or the refresh is not visible) - if you are logged in and have started typing in a barcode slowly, it logs you out - even if you haven't finished typing in a barcode After the patch: - you are logged out after 5 seconds, unless you interrupt it - the login page continues to refresh every 5 seconds - if you are logged in and have started typing in a barcode slowly, it no longer logs you out (it does if you don't enter anything after 5 seconds) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #22 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to David Nind from comment #21)
The thing I most noticed after the patches is that: 1. The self check-in page visible refreshes every 5 seconds. 2. The self check-out login page visible refreshes every 5 seconds.
Before the patches, this did not happen.
Excellent! That is exactly what we want - a hard refresh to ensure the CSRF token is valid and that user info doesn't remain too long. 5 seconds is probably an extreme case, but the default of 2 minutes seems reasonable for this -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #23 from David Cook <dcook@prosentient.com.au> --- Hey Nick, I just noticed you took over my authorship for that first patch haha. Fair enough though. Looks like it need some squashing down. I reckon that means I can probably QA this one too. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |nick@bywatersolutions.com |ity.org | CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181694|0 |1 is obsolete| | --- Comment #24 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 181874 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181874&action=edit Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181695|0 |1 is obsolete| | --- Comment #25 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 181875 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181875&action=edit Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #26 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Nice clear fix. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #27 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hm, I don't quite understand how these happen? FAIL koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt FAIL tidiness File is not tidy, please run `perl misc/devel/tidy.pl koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt` -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #28 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Tidy fails: kohadev-koha@kohadevbox:koha(main)$ perl misc/devel/tidy.pl koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt Tidying file 1/1 (koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt) [error] Sz8kRHIZ6p.tt: SyntaxError: CssSyntaxError: Unknown word (1:1) [error] > 1 | [% Koha.Preference('OPACUserCSS') | $raw %] [error] | ^ at misc/devel/tidy.pl line 112. Some files cannot be tidied: * koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt [error] Sz8kRHIZ6p.tt: SyntaxError: CssSyntaxError: Unknown word (1:1) [error] > 1 | [% Koha.Preference('OPACUserCSS') | $raw %] [error] | ^ Looks like a false positive, but can you please double check? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #29 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 182022 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182022&action=edit Bug 36586: Fix tidy -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #30 from Jonathan Druart <jonathan.druart@gmail.com> --- QA script AND pre-commit hook must have caught that. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181874|0 |1 is obsolete| | Attachment #181875|0 |1 is obsolete| | Attachment #182022|0 |1 is obsolete| | --- Comment #31 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 182023 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182023&action=edit Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Bug 36586: Fix tidy -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #32 from Jonathan Druart <jonathan.druart@gmail.com> --- We need to squash here. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #33 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Kristi <kkrueger@cuyahogalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kkrueger@cuyahogalibrary.or | |g --- Comment #34 from Kristi <kkrueger@cuyahogalibrary.org> --- We are excited to see this for 25.05! Could this be backported to 24.11? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_11_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Emmi Takkinen <emmi.takkinen@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emmi.takkinen@koha-suomi.fi --- Comment #35 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- I'm little late on this, but to me it seems that timeout doesn't currently work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just after few seconds. Changing greater value to SelfCheckInTimeout doesn't help. Also reloading the page takes sometimes a long time which can lead to situation where patron might try to log in while loading is still processed and their login credentials are swiped out after loading is finished. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #36 from David Cook <dcook@prosentient.com.au> --- (In reply to Emmi Takkinen from comment #35)
I'm little late on this, but to me it seems that timeout doesn't currently work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just after few seconds. Changing greater value to SelfCheckInTimeout doesn't help. Also reloading the page takes sometimes a long time which can lead to situation where patron might try to log in while loading is still processed and their login credentials are swiped out after loading is finished.
I'll take a quick look to see if I can reproduce. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #37 from David Cook <dcook@prosentient.com.au> --- (In reply to Emmi Takkinen from comment #35)
I'm little late on this, but to me it seems that timeout doesn't currently work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just after few seconds. Changing greater value to SelfCheckInTimeout doesn't help. Also reloading the page takes sometimes a long time which can lead to situation where patron might try to log in while loading is still processed and their login credentials are swiped out after loading is finished.
So you mention SelfCheckInTimeout and SCO in the same sentence, but the former belongs to the SCI feature and the latter is the SCO feature. They're two different things. SelfCheckTimeout is used for: http://localhost:8080/cgi-bin/koha/sco/sco-main.pl This is working correctly for me. It's taking the configured amount of time (e.g. 120 or 118 if I set that in SelfCheckTimeout) SelfCheckInTimeout is used for: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl This is working correctly for me too. It's taking the configured amount of time (e.g. 120 or 111 as I set in SelfCheckInTimeout) -- The reload should also be very fast. If it's slow for you, it might be due to your server being very busy. Very weird that the SCO reloads just after few seconds. Sounds like you've got other problems with your Koha that you'll need to troubleshoot. Or maybe I'm not following the exact same steps as you and it works in many scenarios but not all? You can check the timer via the browser console using the following on the appropriate interface: console.log(window.sco_login_timer); console.log(window.sci_login_timer); That will show you the timeout threshold and the current idle time. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #38 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- (In reply to David Cook from comment #37)
(In reply to Emmi Takkinen from comment #35)
I'm little late on this, but to me it seems that timeout doesn't currently work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just after few seconds. Changing greater value to SelfCheckInTimeout doesn't help. Also reloading the page takes sometimes a long time which can lead to situation where patron might try to log in while loading is still processed and their login credentials are swiped out after loading is finished.
So you mention SelfCheckInTimeout and SCO in the same sentence, but the former belongs to the SCI feature and the latter is the SCO feature. They're two different things.
SelfCheckTimeout is used for: http://localhost:8080/cgi-bin/koha/sco/sco-main.pl This is working correctly for me. It's taking the configured amount of time (e.g. 120 or 118 if I set that in SelfCheckTimeout)
SelfCheckInTimeout is used for: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl This is working correctly for me too. It's taking the configured amount of time (e.g. 120 or 111 as I set in SelfCheckInTimeout)
-- Loading does work correctly, I just mixed up those two sysprefs with each other. So no problem there, sorry for that.
The reload should also be very fast. If it's slow for you, it might be due to your server being very busy.
Very weird that the SCO reloads just after few seconds. Sounds like you've got other problems with your Koha that you'll need to troubleshoot.
Or maybe I'm not following the exact same steps as you and it works in many scenarios but not all?
You can check the timer via the browser console using the following on the appropriate interface: console.log(window.sco_login_timer); console.log(window.sci_login_timer);
That will show you the timeout threshold and the current idle time.
I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|25.05.00 |25.05.00,24.11.05 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #39 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 24.11.x for 24.11.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.derscheid@lmscloud.de Keywords|rel_24_11_candidate | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cbrannon@cdalibrary.org --- Comment #40 from Christopher Brannon <cbrannon@cdalibrary.org> --- This patch may have broken the print slip function in SCO. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40158 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40158 [Bug 40158] SCO receipt doesnt print when SelfCheckReceiptPrompt is on -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40224 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40224 [Bug 40224] Replace use of location.href with POST logout form -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com --- Comment #41 from Kyle M Hall (khall) <kyle@bywatersolutions.com> ---
I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
We've had reports of the same. We've had partners in production have their servers become unusable because the self-checks are sending 50 logout requests a second. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #42 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- (In reply to Kyle M Hall (khall) from comment #41)
I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
We've had reports of the same. We've had partners in production have their servers become unusable because the self-checks are sending 50 logout requests a second.
We are having yet another instance of this issue. I think it may be time to consider reverting until we have a solution. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #43 from David Cook <dcook@prosentient.com.au> --- (In reply to Kyle M Hall (khall) from comment #42)
(In reply to Kyle M Hall (khall) from comment #41)
I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
We've had reports of the same. We've had partners in production have their servers become unusable because the self-checks are sending 50 logout requests a second.
We are having yet another instance of this issue. I think it may be time to consider reverting until we have a solution.
That's understandable, although if it's reverted I doubt that it'll ever be fixed either since it doesn't seem reproduceable in KTD? -- I'd say a good middle ground would be to add a sanity check to "_timer_increment()" in koha-tmpl/opac-tmpl/bootstrap/js/timeout.js Based on the description of the reports, there must be a problem with "this.idle_timeout" not getting set correctly, so within that function we make sure that this.idle_timeout is a number and greater than 30 seconds. Otherwise, we default to 30 seconds. You know... as I say that... I have an idea about the problem here. Be right back... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #44 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #43)
You know... as I say that... I have an idea about the problem here. Be right back...
I thought maybe invalid data was getting into the "idle_timeout" field, but " 10" and " 10" work fine. "10a" actually never activated so it's the opposite problem. -- Aha! I think I've worked it out. If you have a single blank space in SelfCheckTimeout, it'll reload every second. Everyone hold your applause. I'll open a new ticket and attach a patch. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #45 from David Cook <dcook@prosentient.com.au> --- (In reply to Emmi Takkinen from comment #38)
You can check the timer via the browser console using the following on the appropriate interface: console.log(window.sco_login_timer); console.log(window.sci_login_timer);
That will show you the timeout threshold and the current idle time.
I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
Emmi, did you try out those troubleshooting steps I mentioned previously? I guess if it was reloading too fast it may have been difficult. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40336 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40336 [Bug 40336] Self-checkouts restart every second if invalid data in timeout sysprefs -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #46 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #44)
I'll open a new ticket and attach a patch.
Bug 40336 - let's follow up on this issue there -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #47 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #46)
(In reply to David Cook from comment #44)
I'll open a new ticket and attach a patch.
Bug 40336 - let's follow up on this issue there
Patch posted there. Now fingers crossed that it actually fixes the problems you folk have had. It should fix it. I can't say for sure what values your libraries had in the sysprefs, but that's the clearest answer within Koha. If that patch doesn't fix it, then I'd say there's an issue with the PCs being used. Perhaps some software on it that is triggering reloads every second. I have seen that with catalogue PCs recently. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #48 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- (In reply to David Cook from comment #45)
(In reply to Emmi Takkinen from comment #38)
You can check the timer via the browser console using the following on the appropriate interface: console.log(window.sco_login_timer); console.log(window.sci_login_timer);
That will show you the timeout threshold and the current idle time.
I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
Emmi, did you try out those troubleshooting steps I mentioned previously? I guess if it was reloading too fast it may have been difficult.
I did, but I can't remember anymore what the out come was apart from that frequent reloading :D But I'll test bug 40336 to see what happens. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #49 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- This has become a pretty big problem and Koha sites are being taken down because of this fix. I think this is going to require some more thought. For now let's revert this from main, 25.05, and 24.11. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #50 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- This patchset has been reverted from main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40108 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40108 [Bug 40108] Self-checkout print receipt option not working -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |In Discussion -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #51 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Patch has been reverted on 25.05.x. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00,24.11.05 | released in| | CC| |fridolin.somers@biblibre.co | |m --- Comment #52 from Fridolin Somers <fridolin.somers@biblibre.com> --- Patch has been reverted on 24.11.x for 24.11.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Michael Grgurev <mike.grgurev@mainlib.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mike.grgurev@mainlib.org --- Comment #53 from Michael Grgurev <mike.grgurev@mainlib.org> --- Only noticing this bug listing after doing an extensive amount of customization on our Self Checks. Had implemented our own client-side inactivity timer via javascript to refresh the page every 10 minutes, in addition to adding fallback logic to return back to the SCO page after an error rather then stuck on the OPAC error page. Is the CSRF token expiration still fixed at 8 hrs? I would have guessed even less. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #54 from David Cook <dcook@prosentient.com.au> --- (In reply to Michael Grgurev from comment #53)
Is the CSRF token expiration still fixed at 8 hrs? I would have guessed even less.
Yeah I think so -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #55 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Michael Grgurev from comment #53)
Only noticing this bug listing after doing an extensive amount of customization on our Self Checks. Had implemented our own client-side inactivity timer via javascript to refresh the page every 10 minutes, in addition to adding fallback logic to return back to the SCO page after an error rather then stuck on the OPAC error page.
Is the CSRF token expiration still fixed at 8 hrs? I would have guessed even less.
Michael, We've been having some issues with this token on the SCO as well, and well under the 8 hours. Would you be able to share your javascript customization somewhere? I am very interested and desperate to get the SCO working like it should. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #56 from Michael Grgurev <mike.grgurev@mainlib.org> --- Hey Christopher! It largely accomplishes what the proposed patch seems to do. I'll paste what we're using below, but hopefully we can get the above patch tested and pushed through. Reviewing the patch code again, the one thing that comes to mind is if touch input detection might need to be added or if most browsers/devices translate that accordingly. (In reply to Christopher Brannon from comment #55)
Michael, We've been having some issues with this token on the SCO as well, and well under the 8 hours. Would you be able to share your javascript customization somewhere? I am very interested and desperate to get the SCO working like it should.
-- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #57 from Michael Grgurev <mike.grgurev@mainlib.org> --- /* Interim fix for use in SCOUserJS */ /* ---- Self checkout page reload on idle to avoid CSRF errors ---- */ /* IF STATEMENT: Limit to cardnumber entry screen, though not strictly necessary */ if(document.body.id == "sco_main" && !$('body').hasClass('CheckingOut')) { let timeoutMinutes = 5; /* Time, in minutes, to refresh when no user input. */ let idleTimer = 0; const idleInterval = setInterval(idleUpdate, 1000); const idleThreshold = timeoutMinutes * 60; function resetTimer() { idleTimer = 0; } function idleUpdate() { idleTimer++; if (idleTimer >= idleThreshold) { location.reload(true); /* Reload page to refresh CSRF token */ clearInterval(idleInterval); } } /* Check for standard user input events (no reload when interaction is occuring) */ for (var e of ["mousemove","keypress","mousedown","touchstart","scroll"]) { document.addEventListener(e, resetTimer); } resetTimer(); } -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Cheryl <clackman@fargolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |clackman@fargolibrary.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus@libriotech.no -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 --- Comment #58 from Magnus Enger <magnus@libriotech.no> --- We have tested the JS from Michael by adding it to SCOUserJS. It looks like it helps, but we are still getting some reports of users getting errors related to CSRF-tokens. Has others tested this and what have been your experiences? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42200 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36586 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org