[Bug 38258] New: Connecting to koha without the proper CGI cookie can disconnect every session
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Bug ID: 38258 Summary: Connecting to koha without the proper CGI cookie can disconnect every session Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: baptiste.wojtkowski@biblibre.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org To reproduce : 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected I'm not sure about the exact mechanism leading to a disconnection, but this is due to :
check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. This is true for all the results of:
git grep "check_cookie_auth.*cookie.*CGISESSID"
-- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |baptiste.wojtkowski@biblibr |ity.org |e.com Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|24.05 |Main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Connecting to koha without |Connecting to koha without |the proper CGI cookie can |the proper CGI cookie can |disconnect every session |disconnect every sessions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Connecting to koha without |Connecting without a proper |the proper CGI cookie can |CGI cookie can disconnect |disconnect every sessions |all sessions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|minor |major -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #1 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 173361 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173361&action=edit Bug 38258: Force scalar context for cookie calls (part 1) To reproduce : 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected I'm not sure about the exact mechanism leading to a disconnection, but this is due to :
check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. This is true for all the results of:
git grep "check_cookie_auth.*cookie.*CGISESSID"
Correct all the calls for cookies extracted from $input->cookie('CGISESSID') TEST PLAN: 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected 4 - Apply patch 5 - Repeat 1-3 and see you do not have been disconnected -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #2 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 173362 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173362&action=edit Bug 38258: Force scalar context for cookie calls (part 2) Correct all the calls for cookies extracted from $cgi->cookie('CGISESSID') -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #3 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 173363 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173363&action=edit Bug 38258: Force scalar context for cookie calls (part 3) Correct all the calls for cookies extracted from $query->cookie('CGISESSID') -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #4 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 173364 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173364&action=edit Bug 38258: Force scalar context for cookie calls (part 4) Correct the last call for cookies -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #5 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Note: I do not pass QA for tidyness, I'm not sure it would be a good idea, tidyness requires to realign all "=" of each code block, which does not look like being in the scope of the patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #6 from David Nind <david@davidnind.com> --- I had a go at testing. However, I wasn't able to replicate the issue using steps 1-3 from the test plan. I was NOT logged out of the staff interface when clicking any links. Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #7 from David Cook <dcook@prosentient.com.au> --- I am skeptical about the analysis and patches for this one. Is this for the main branch or a stable branch? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #8 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- (In reply to David Nind from comment #6)
I had a go at testing.
However, I wasn't able to replicate the issue using steps 1-3 from the test plan.
I was NOT logged out of the staff interface when clicking any links.
Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04.
Hi ! What was your curl output ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #9 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- (In reply to David Cook from comment #7)
I am skeptical about the analysis and patches for this one.
Is this for the main branch or a stable branch?
This is for main, yes :) We had a very strange issue with some clients experiencing random disconnections. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- (In reply to Baptiste Wojtkowski (bwoj) from comment #8)
(In reply to David Nind from comment #6)
I had a go at testing.
However, I wasn't able to replicate the issue using steps 1-3 from the test plan.
I was NOT logged out of the staff interface when clicking any links.
Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04.
Hi ! What was your curl output ?
Like David, I cannot reproduce this problem, when using koha-testing-docker. The curl output is a HTTP 403 error with a HTML page returned from Koha. -- Baptiste, can you try to reproduce this problem using koha-testing-docker? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #11 from David Cook <dcook@prosentient.com.au> --- (In reply to Baptiste Wojtkowski (bwoj) from comment #9)
We had a very strange issue with some clients experiencing random disconnections.
For older versions, there was a problem with C4::Context->userenv not being handled correctly, which could lead to 403 problems when using anti-CSRF. But that's not a problem in "main". Other than that... if your cleanup_database.pl overlaps with actual usage, you could have sessions deleted out of the database, which leads to seemingly random disconnections. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258 --- Comment #12 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> ---
Baptiste, can you try to reproduce this problem using koha-testing-docker?
Hum.. It looks like it's time to take a look at ktd /o/ It might take a few weeks for me to be fully operational and provide the test plan. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org