[Bug 26069] New: Twitter share button leaks information to Twitter
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Bug ID: 26069 Summary: Twitter share button leaks information to Twitter Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: x.schindel@googlemail.com QA Contact: testopia@bugs.koha-community.org If any share button is active on the details page to some media (must not necessarily be the Twitter button), then requests are sent to Twitter which contain information about the currently displayed media in the referer header Example: .../cgi-bin/koha/opac-detail.pl?biblionumber=21&query_desc=kw%2Cwrdl%3A%20sch*). This is not acceptable from a data privacy point of view. Instead of using the Twitter script a simple link behind the Twitter share button should be used (as already done e.g. for sharing with Facebook or LinkedIn). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |major -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 108824 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=108824&action=edit Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org Assignee|oleonard@myacpl.org |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- (In reply to Jonathan Druart from comment #1)
Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter
I'm still getting the "query_desc" part of the URL: https://twitter.com/intent/tweet?url=http%3A%2F%2F127.0.0.1%3A8080%2Fcgi-bin... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #3 from x.schindel@googlemail.com --- Adjusting the URL used for the Twitter link will not solve the issue. As long as the following script-tag <script id="twitter-wjs" src="//platform.twitter.com/widgets.js"></script> is part of the page there will be (a dark) request to Twitter which contains the number of the displayed media in the referer header. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #108824|0 |1 is obsolete| | --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 108832 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=108832&action=edit Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Amit Gupta <amitddng135@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |amit.gupta@informaticsgloba | |l.com, | |amitddng135@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Amit Gupta <amitddng135@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #108832|0 |1 is obsolete| | --- Comment #5 from Amit Gupta <amitddng135@gmail.com> --- Created attachment 109121 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=109121&action=edit Bug 26069: Pass correct URL to twitter Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Amit Gupta <amitddng135@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #109121|0 |1 is obsolete| | --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 109206 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=109206&action=edit Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to x.schindel from comment #3) Can you confirm it now works as you expected? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I verified it using the dev tools in the broswer - I saw the request to Twitter without the patch, but not with it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #9 from Amit Gupta <amitddng135@gmail.com> --- I applied the patch on my development machine and it's worked OK. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |20.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 --- Comment #10 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 20.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable CC| |lucas@bywatersolutions.com Version(s)|20.11.00 |20.11.00, 20.05.04 released in| | --- Comment #11 from Lucas Gass <lucas@bywatersolutions.com> --- backported to 20.05.x for 20.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kelly@bywatersolutions.com --- Comment #12 from Lucas Gass <lucas@bywatersolutions.com> --- *** Bug 24520 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aleisha@catalyst.net.nz Version(s)|20.11.00, 20.05.04 |20.11.00, 20.05.04, released in| |19.11.10 Status|Pushed to stable |Pushed to oldstable --- Comment #13 from Aleisha Amohia <aleisha@catalyst.net.nz> --- backported to 19.11.x for 19.11.10 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26069 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable CC| |victor@tuxayo.net Version(s)|20.11.00, 20.05.04, |20.11.00, 20.05.04, released in|19.11.10 |19.11.10, 19.05.15 --- Comment #14 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Backported to 19.05.x branch for 19.05.15 (triple checked that the strings were untouched) -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org