[Bug 41926] New: Disable OPAC search form after first submitting it, as a counter measure to spam
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 Bug ID: 41926 Summary: Disable OPAC search form after first submitting it, as a counter measure to spam Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: lari.taskula@hypernova.fi QA Contact: testopia@bugs.koha-community.org We occasionally notice the same search query being placed multiple times in rapid succession. While we do ratelimiting that eventually blocks the spam (whether intentional or not), the first counter measure should be to disable the form submit by JavaScript. I propose once the search form is first submitted, we send the query and then disable the submit function. If patron then re-submits the form before search results are loaded, the browser will not send another query to Koha. Now if anything changes within the form before the results are loaded, we re-enable the submit so that if they are quick enough, they could still modify their query before the results. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 --- Comment #1 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 193835 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193835&action=edit Screencast to describe the problem -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 --- Comment #2 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 193838 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193838&action=edit Bug 41926: Add JS to prevent forms from resubmitting -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 --- Comment #3 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 193839 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193839&action=edit Bug 41926: Prevent resubmits from masthead search form To test: 0. Before applying this patch, 1. Open a console and run the following command tail -f /var/log/apache2/other_vhosts_access.log -n 0 | grep 'GET /cgi-bin/koha/opac-search.pl' 2. Navigate to your OPAC main page 3. Observe "Search the catalog" text box and the green search icon to the right 4. Click the search icon as many times and as fast as you can 5. Observe the console window from step 1 having multiple requests 6. Apply patch, 7. Press Ctrl+C in your console and type "clear" (without quotes)" 8. Repeat steps 1-4 9. Observe the console window from step 1 only having one request -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 --- Comment #4 from Lari Taskula <lari.taskula@hypernova.fi> --- (In reply to Lari Taskula from comment #0)
Now if anything changes within the form before the results are loaded, we re-enable the submit so that if they are quick enough, they could still modify their query before the results. This does leave room for spamming with the keyboard;
1. Activate the search field text box by clicking it, and very rapidly: 2. Press enter 3. Press a 4. Press enter 5. Press a 6. Press enter 7. ..repeat.. such that each enter press would send another request to the server. We can either accept that, or we remove the proposed ability to resend the form if values change before the next page has loaded. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |lari.taskula@hypernova.fi -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40327 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #5 from David Cook <dcook@prosentient.com.au> --- I think there's already a mechanism for this defined in koha-tmpl/opac-tmpl/bootstrap/js/global.js with jQuery.fn.preventDoubleFormSubmit You can see an example at koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt That said, it is a deprecated API, so we should probably update global.js at some point... -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org