http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Mason JAMES <mason@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Back-button in OPAC show |Back-button in OPAC shows |previous user's details, |previous user's details, |after LOGOUT |after LOGOUT -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #3 from Mason JAMES <mason@kohaaloha.com> 2010-11-07 13:21:52 UTC ---

this patch has only been tested in firefox so far,

this patch should work in google-chrome too (running in kiosk-mode) http://www.google.co.nz/support/forum/p/Chrome/thread?tid=23c03746e3aa03f9&hl=en i can't currently confirm this :/ -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #5 from Mason JAMES <mason@kohaaloha.com> 2010-11-08 01:22:44 UTC --- (In reply to comment #4)

Could this be made a customization via OpacUserJS instead?

yes, there's a few ways to do it... i think an on/off syspref is prolly the best way. i think i'll resubmit the patch as a syspref -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 M. James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #2733|0 |1 is obsolete| | --- Comment #6 from M. James <mtj@kohaaloha.com> 2011-07-27 22:33:28 UTC --- Created attachment 4761 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4761 new patch -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|rel_3_2 |master --- Comment #8 from Mason James <mtj@kohaaloha.com> 2011-09-22 08:26:03 UTC --- (In reply to comment #2)

patch applied to tag 'v3.02.00'

this patch has only been tested in firefox so far, and requires a firefox config-change.

edit firefox's 'user.js' file and add this line to it user_pref("dom.allow_scripts_to_close_windows", true);

FYI: according to the web-security forums, this is the best/only way to get around this problem

an update on this bug... ive come to a situation that i cant find a solution for the patch works *perfectly* for browsers with the 'user_pref("dom.allow_scripts_to_close_windows")' pref set to 'TRUE' so, the good news is library-staff can force this setting on their OPAC's browser, and this patch will work great! the bad news is ... this patch works horribly for browsers with the pref set to 'FALSE' (which is default) and *fails* logging out a person :/ the obvious solution here is to test whether a browser has the 'dom.allow_scripts_to_close_windows' value set to TRUE then execute this js code, or not... sounds easy?, nope... i cant work out a technique to get the 'dom.allow_scripts_to_close_windows' value from a browser (my hunch is that it's probably deliberately impossible to determine that info) so, the original security/privacy issue still remains in MASTER - but this patch is broken -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jesse@bywatersolutions.com --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- *** Bug 14799 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion --- Comment #12 from Mason James <mtj@kohaaloha.com> --- (In reply to Marc Véron from comment #11)

After a logout, there could be a message similar to the following:

"Logout privacy warning: Please close this browser window if other persons have access to this computer."

Marc, this is a pretty good idea :) silly me for only considering a technical solution -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gmcharlt@gmail.com |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #15 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Jonathan Druart from comment #13)

I have tried to set force_no_caching to output_html_with_http_headers, but I always get a "Document Expired" message from my browser (iceweasel), which is not really kind for users.

Hum, it seems I haven't tested correctly yesterday, it works quite well :) -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #42648|0 |1 is obsolete| | --- Comment #17 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 42911 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=42911&action=edit Bug 5371: Force no caching for private pages at the OPAC In order no to slow too much the browsing, it is certainly not a good idea to add this cache-control value for all pages at the OPAC. This patch just adds where the author found it could be useful. Test plan: 1/ Login at the OPAC 2/ Go on the account page (opac/opac-account.pl) 3/ Click log out 4/ Use the back button of your browser Without this patch you will see the previous page. With this patch, the previous page will be reloaded and you will be redirected to the login form. -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #19 from Marc Véron <veron@veron.ch> --- With Firefox 40.0.3 (Win), I tested all left tabs by doing the following: - Log in to OPAC - Go to a tab at the left side - Logout - Hit browser's back button Tabs tested: - your summary: OK, however if you log in from the home page, then immediately log out and then hit the back button, the browser asks says 'Document expired (...) try again'. If you do so ('Send data again'), you are logged in. You can get the same after changing to other tabs by clicking the 'Back' button until you get 'Document expired...' - your fines: OK *) - your personal details: After hitting back button, I get Home > Register a new account. I would expect a login page or the home page - your tags: After hitting back, I see the list of personal tags, patron seems to be logged in again (Name appears in Header). However if e.g. I try to delete a tag, I'm redirected to the Log in page - change your password: OK*) - your search history: 'Back' leads me back to Home > Search history with message 'Your catalog search history is empty'. I would expect a login page or the home page. - your reading history: "Back" displays the Checkout history - your privacy: OK*) - your purchase suggestion: After 'Back', patron seems to be logged in (Name in header), but the page says: "You are not authorized to see pending purchase suggestions. If I then hit the link 'New purchase suggestion' I'm redirected to the page for anonymous suggestions (patron's name disappears from header). - your messaging: After "Back", patron's messaging settings are displayed. If I change them ans submit changes, I get the log in screen *) behalve of case explained under 'your summary' -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #21 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 43002 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=43002&action=edit Bug 5371: (follow-up) Force no caching for private pages at the OPAC Same as previous patch for opac-messaging.pl and opac-readingrecord.pl -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #23 from Marc Véron <veron@veron.ch> --- Created attachment 43004 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=43004&action=edit [Signed-off] Bug 5371: Force no caching for private pages at the OPAC In order no to slow too much the browsing, it is certainly not a good idea to add this cache-control value for all pages at the OPAC. This patch just adds where the author found it could be useful. Test plan: 1/ Login at the OPAC 2/ Go on the account page (opac/opac-account.pl) 3/ Click log out 4/ Use the back button of your browser Without this patch you will see the previous page. With this patch, the previous page will be reloaded and you will be redirected to the login form. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #24 from Marc Véron <veron@veron.ch> --- Created attachment 43005 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=43005&action=edit [Signed-off] Bug 5371: (follow-up) Force no caching for private pages at the OPAC Same as previous patch for opac-messaging.pl and opac-readingrecord.pl Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #26 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 43037 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=43037&action=edit [PASSED QA] Bug 5371: (follow-up) Force no caching for private pages at the OPAC Same as previous patch for opac-messaging.pl and opac-readingrecord.pl Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #28 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Katrin Fischer from comment #27)

Fixes a long existing security and privacy problem, but also changes behaviour a bit: when you are logged in and you try to use the back button, you will see a warning, that the browser won't automatically request the page again.

I don't remember I got a warning. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Kyle M Hall <kyle.m.hall@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle.m.hall@gmail.com --- Comment #30 from Kyle M Hall <kyle.m.hall@gmail.com> --- (In reply to Katrin Fischer from comment #29)

I tested a few times - maybe it's a firefox thing? I was using Firefox in Ubuntu. It was described as a privacy measure to not request pages not cached automatically again.

I also was testing this patch using Chrome and Firefox on OS X. My experience is that some pages would give the "cache miss" error in both browsers and some would just redirect to the login screen. -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |tomascohen@gmail.com --- Comment #32 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Patches pushed to master. Thanks Jonathan! -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #34 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Chris Cormack from comment #33)

I agree with Marc that we need to also waen the users to close the browser, as I can confirm that this fix doesn't work for Firefox

What version are you using? -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #35 from Chris Cormack <chris@bigballofwax.co.nz> --- (In reply to Jonathan Druart from comment #34)

(In reply to Chris Cormack from comment #33)

...

I agree with Marc that we need to also waen the users to close the browser, as I can confirm that this fix doesn't work for Firefox

What version are you using?

It is now ok in the latest version, I am running firefox developer edition, 43.0a2 -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |gmcharlt@gmail.com --- Comment #36 from Galen Charlton <gmcharlt@gmail.com> --- Noting/requesting that as this patch fixes a patron privacy bug, it would be good it for it to be backported. It cherry-picks cleanly onto 3.20.x and with only a minor merge conflict onto 3.18.x. -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #37 from Frédéric Demians <frederic@tamil.fr> --- (In reply to Galen Charlton from comment #36)

Noting/requesting that as this patch fixes a patron privacy bug, it would be good it for it to be backported. It cherry-picks cleanly onto 3.20.x and with only a minor merge conflict onto 3.18.x.

What is the right process for this? Do I have to wait that 3.22 RMaint pushes this patch to its branch for pushing it to 3.20, or do I have to pick it up directly from master? -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 --- Comment #39 from Frédéric Demians <frederic@tamil.fr> --- This patch has been pushed to 3.20.x, will be in 3.20.7. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #41 from Liz Rea <liz@catalyst.net.nz> --- Pushed to 3.18.13, and released. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.