[Bug 40980] New: Clicking a search facet without logging in may trigger a cud-login error
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Bug ID: 40980 Summary: Clicking a search facet without logging in may trigger a cud-login error Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs@lists.koha-community.org Reporter: pedro.amorim@openfifth.co.uk QA Contact: testopia@bugs.koha-community.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com, | |lucas@bywatersolutions.com, | |martin.renvoize@openfifth.c | |o.uk, | |pedro.amorim@openfifth.co.u | |k Assignee|koha-bugs@lists.koha-commun |pedro.amorim@openfifth.co.u |ity.org |k -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #1 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 187634 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=187634&action=edit Bug 40980: Only consider AND|OR|NOT/i operators Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #187634|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 189384 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189384&action=edit Bug 40980: Only consider AND|OR|NOT/i operators Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189384|0 |1 is obsolete| | --- Comment #3 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 189766 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189766&action=edit Bug 40980: Only consider AND|OR|NOT/i operators Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Please explain the relation of this otor with op=cud-login ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #5 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- (In reply to Marcel de Rooy from comment #4)
Please explain the relation of this otor with op=cud-login ?
Hi Marcel yes, of course, this is what I shared with my colleagues internally when diagnosing/fixing this issue almost 2 months ago: op=cud-login is always POSTed when logging in, but because for ElasticSearch an op may be AND OR or NOT it adds it to the facet link, thus causing it to be added to the URL as GET and causing the error. This is my fix for now, but there may be a better approach. ------ Upon looking at it again, my analysis remains the same, but I'll explain again phrasing it differently. 'op' is a param that ElasticSearch considers for building the search query (AND, OR or NOT), but 'op' is also what we use for POST cud-login (and other form submissions). With the above in mind, in Koha, when we're logged out and attempt to access a URL with a GET parameter, e.g. http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=19. We're prompted to login, and after login we're brought to the borrowernumber 19 page, but if we look at the URL, we see that it looks like this: http://localhost:8081/cgi-bin/koha/circ/circulation.pl. This means borrowernumber=19 was passed onto circulation.pl as a POST parameter, not as GET. This is what I think is happening to the ElasticSearch issue above, op='cud-login' is passed to search.pl as a POST param (can be confirmed by the network browser tab) which then causes the following code in facets.inc to add the op=cud-login to the facet link as a GET param: [% SET url = "/cgi-bin/koha/catalogue/search.pl?" _ query_cgi _ limit_cgi %] Because query_cgi contains the problematic op=cud-login, seemingly not distinguishing between GET and POST params, if it matters here at all. I've explained the issue the best I can (and to the best of my knowledge), and I'm happy to discuss my patch further and/or other alternative patches. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Pedro Amorim from comment #5)
(In reply to Marcel de Rooy from comment #4)
Please explain the relation of this otor with op=cud-login ?
Hi Marcel yes, of course, this is what I shared with my colleagues internally when diagnosing/fixing this issue almost 2 months ago:
Thx for explaining. I am seeing it in a debug print also when using Zebra. But there is no error. I wonder if we should not just remove cud-login from the @operators in catalogue/search? It seems to be read twice btw. Are you sure we are not passing other operators than AND, OR, NOT ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #7 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 190350 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190350&action=edit Bug 40980: [ALTERNATIVE] Sanitize operators param Ensure it does not contain 'cud-login' Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #8 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- (In reply to Marcel de Rooy from comment #6)
I wonder if we should not just remove cud-login from the @operators in catalogue/search? It seems to be read twice btw.
Are you sure we are not passing other operators than AND, OR, NOT ?
I am fairly certain though your question does highlight the fact that it would be yet another place that would need maintaining should the need of other possible come up. I've provided an alternative patch, instead tackling the issue at catalogue/search as you've pointed out. Following the same test plan proves this alternative patch also fixes it. This alternative approach may indeed be more sensible, please let me know if you agree. Thanks for looking Marcel. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #9 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Just for the record: catalogue/search.pl:# operators include boolean and proximity operators and are used opac/opac-search.pl:# operators include boolean and proximity operators and are used Well, Zebra does not use those proximity operators definitely. Not sure about Elastic. etc/zebradb/explain-biblios.xml: <!-- <supports type="proximity"></supports> --> <!-- DEAD, title = (house prox/distance=1/unit=word the) FAILS --> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189766|0 |1 is obsolete| | Attachment #190350|0 |1 is obsolete| | --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 190351 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190351&action=edit Bug 40980: [ALTERNATIVE] Sanitize operators param Ensure it does not contain 'cud-login' Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This fixes using facets in release notes| |the OPAC for searching when | |not logged in, where | |Elasticsearch or OpenSearch | |is used as the search | |engine. In some | |circumstances, a 403 | |Forbidden Error was | |icnorrectly generated (this | |is related to changes made | |in previous versions of | |Koha to improve form | |security). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|26.05.00 |26.05.00,25.11.01 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 --- Comment #12 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This fixes using facets in |This fixes using facets in release notes|the OPAC for searching when |the OPAC for searching when |not logged in, where |not logged in, where |Elasticsearch or OpenSearch |Elasticsearch or OpenSearch |is used as the search |is used as the search |engine. In some |engine. In some |circumstances, a 403 |circumstances, a 403 |Forbidden Error was |Forbidden Error was |icnorrectly generated (this |incorrectly generated (this |is related to changes made |is related to changes made |in previous versions of |in previous versions of |Koha to improve form |Koha to improve form |security). |security). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to stable |Needs documenting --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- This is minor, lets skip backport on older branches -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40980 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #14 from David Nind <david@davidnind.com> --- Bug fix, no changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org