[Bug 20122] New: Empty and close link on cart page not working (js security)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Bug ID: 20122 Summary: Empty and close link on cart page not working (js security) Change sponsored?: --- Product: Koha Version: 17.05 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: mark.gavillet@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org Clicking the 'Empty cart and close' link when viewing the contents of a cart at /cgi-bin/koha/opac-basket.pl does not work. There are javascript security errors because the page opens in a new window but scripts in /opac-tmpl/bootstrap/js/basket.js such as updateBasket try to access and change values in the parent window (referred to as top.opener) - this is blocked by the browser. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Fiona Borthwick <fiona.borthwick@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fiona.borthwick@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Which version of Koha? Which browser? Works for me on master with Firefox 58.0.1 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 --- Comment #2 from mark.gavillet@ptfs-europe.com --- Sorry, thought I'd mentioned the Koha version! It's Koha 17.05.08, browsers tested are: Chrome 63.0.3239.132 Safari 11.0.2 Edge 40.15063.674.0 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Work for me on v17.05.08 and chromium 64.0.3282.119 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |oleonard@myacpl.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #4 from Owen Leonard <oleonard@myacpl.org> --- I've tested this in multiple browsers in master and on 17.05.09 and cannot reproduce the problem. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED CC| |kyle@bywatersolutions.com Resolution|INVALID |--- --- Comment #5 from Kyle M Hall <kyle@bywatersolutions.com> --- I was able to reproduce on master. It appears that the empty link works until you reload the page, then the items come back. Furthermore the remove items button doesn't work if *all* items are selected, but does if only some of the cart items are selected. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEW -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|17.05 |master Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com --- Comment #6 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Kyle M Hall from comment #5)
I was able to reproduce on master. It appears that the empty link works until you reload the page, then the items come back. Furthermore the remove items button doesn't work if *all* items are selected, but does if only some of the cart items are selected.
All because bib_list cookie is not properly deleted. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 --- Comment #7 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 73788 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=73788&action=edit Bug 20122: Empty lists keep coming back This is caused by bib_list not being deleted. The path was not explicitly set. This patch adds path=/ explicitly to ensure it does get deleted. TEST PLAN --------- 1) search for 'the' in OPAC 2) add several items to cart. 3) look at your cart. 4) empty and close the cart, select all->remove -- either way window closes and it looks empty. 5) refresh the page -- cart comes back. -- in chromium inspecting the page, specifically the "Application" area, bib_list is shown as a cookie still. 6) apply patch 7) restart_all and empty cache forcing JS reload 8) repeat steps 1-5 -- this time cart stays empty. -- and the bib_list cookie is gone 9) run koha qa test tools. NOTE: Shout out to Owen Leonard for this version. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #73788|0 |1 is obsolete| | --- Comment #8 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 73789 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=73789&action=edit Bug 20122: Empty lists keep coming back This is caused by bib_list not being deleted. The path was not explicitly set. This patch adds path=/ explicitly to ensure it does get deleted. TEST PLAN --------- 1) search for 'the' in OPAC 2) add several items to cart. 3) look at your cart. 4) empty and close the cart, select all->remove -- either way window closes and it looks empty. 5) refresh the page -- cart comes back. -- in chromium inspecting the page, specifically the "Application" area, bib_list is shown as a cookie still. 6) apply patch 7) restart_all and empty cache forcing JS reload 8) repeat steps 1-5 -- this time cart stays empty. -- and the bib_list cookie is gone 9) run koha qa test tools. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #73789|0 |1 is obsolete| | --- Comment #9 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 73790 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=73790&action=edit Bug 20122: Empty lists keep coming back This is caused by bib_list not being deleted. The path was not explicitly set. This patch adds path=/ explicitly to ensure it does get deleted. TEST PLAN --------- 1) search for 'the' in OPAC 2) add several items to cart. 3) look at your cart. 4) empty and close the cart, select all->remove -- either way window closes and it looks empty. 5) refresh the page -- cart comes back. -- in chromium inspecting the page, specifically the "Application" area, bib_list is shown as a cookie still. 6) apply patch 7) restart_all and empty cache forcing JS reload 8) repeat steps 1-5 -- this time cart stays empty. -- and the bib_list cookie is gone -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Roch D'Amour <roch.damour@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Roch D'Amour <roch.damour@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #73790|0 |1 is obsolete| | --- Comment #10 from Roch D'Amour <roch.damour@inlibro.com> --- Created attachment 73803 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=73803&action=edit Bug 20122: Empty lists keep coming back This is caused by bib_list not being deleted. The path was not explicitly set. This patch adds path=/ explicitly to ensure it does get deleted. TEST PLAN --------- 1) search for 'the' in OPAC 2) add several items to cart. 3) look at your cart. 4) empty and close the cart, select all->remove -- either way window closes and it looks empty. 5) refresh the page -- cart comes back. -- in chromium inspecting the page, specifically the "Application" area, bib_list is shown as a cookie still. 6) apply patch 7) restart_all and empty cache forcing JS reload 8) repeat steps 1-5 -- this time cart stays empty. -- and the bib_list cookie is gone Signed-off-by: Roch D'Amour <roch.damour@inlibro.com> using firefox 59.0.2 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #73803|0 |1 is obsolete| | --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 73828 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=73828&action=edit Bug 20122: Explicitly set path to fix emptying cart functionality This is caused by bib_list not being deleted. The path was not explicitly set. This patch adds path=/ explicitly to ensure it does get deleted. TEST PLAN --------- 1) search for 'the' in OPAC 2) add several items to cart. 3) look at your cart. 4) empty and close the cart, select all->remove -- either way window closes and it looks empty. 5) refresh the page -- cart comes back. -- in chromium inspecting the page, specifically the "Application" area, bib_list is shown as a cookie still. 6) apply patch 7) restart_all and empty cache forcing JS reload 8) repeat steps 1-5 -- this time cart stays empty. -- and the bib_list cookie is gone Signed-off-by: Roch D'Amour <roch.damour@inlibro.com> using firefox 59.0.2 Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Mark, please remember that the patch subject line should describe the patch! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Empty and close link on |Empty and close link on |cart page not working (js |cart page not working |security) | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 --- Comment #13 from Owen Leonard <oleonard@myacpl.org> --- I had assigned this bug to myself, and told you that I had a fix ready. I'm not sure why you duplicated my effort. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |mtompset@hotmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #14 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 18.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com Status|Pushed to Master |Pushed to Stable --- Comment #15 from Nick Clemens <nick@bywatersolutions.com> --- Pushed to stable for 17.11.06 Awesome work all! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #16 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.05.x for v17.05.12 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20122 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to Stable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org