Crashes on new Opac Recent Searches cookie in older Koha versions
Hi, Recently two commits were added that move the search history cookie to a new format. commit 961617765ef25bde32cb050ad016f3b063661ef8 (no bug number, from Galen) commit 488a3d6fed57b4e0d773157ee4a6ab7e4775e7a4 (no bug number, from Galen) I have been looking for these patches on Bugzilla, but I cannot find them. Perhaps they are there, but I may have used the wrong search terms. These patches have a nasty side-effect. If you use an older Koha version and also current master on the same system for testing, the old Koha version will stumble over this (shared) cookie: Storable binary image v45.123 more recent than I am (v2.8) at /usr/lib64/perl5/Storable.pm line 416, at /usr/share/koha/maintclone/C4/Auth.pm line 293. So to overcome this problem, you must delete the KohaOpacRecentSearches cookie AND set preference EnableOpacSearchHistory to off in the old system. Deleting the search cookie every time, as updated by the master clone, is not really an option :) Since I cannot find the bug where this development was documented, I do not know if this side-effect was discussed, tested etc. But for changes like this, a question like: Can this change affect older Koha versions somehow? would be fine to address at the least.. Thanks, Marcel
The commits below date back from end of July. Is there any additional relation to the Bcrypt patches pushed more recently? Van: koha-devel-bounces@lists.koha-community.org [mailto:koha-devel-bounces@lists.koha-community.org] Namens Marcel de Rooy Verzonden: donderdag 10 oktober 2013 12:17 Aan: koha-devel@lists.koha-community.org Onderwerp: [Koha-devel] Crashes on new Opac Recent Searches cookie in older Koha versions Hi, Recently two commits were added that move the search history cookie to a new format. commit 961617765ef25bde32cb050ad016f3b063661ef8 (no bug number, from Galen) commit 488a3d6fed57b4e0d773157ee4a6ab7e4775e7a4 (no bug number, from Galen) I have been looking for these patches on Bugzilla, but I cannot find them. Perhaps they are there, but I may have used the wrong search terms. These patches have a nasty side-effect. If you use an older Koha version and also current master on the same system for testing, the old Koha version will stumble over this (shared) cookie: Storable binary image v45.123 more recent than I am (v2.8) at /usr/lib64/perl5/Storable.pm line 416, at /usr/share/koha/maintclone/C4/Auth.pm line 293. So to overcome this problem, you must delete the KohaOpacRecentSearches cookie AND set preference EnableOpacSearchHistory to off in the old system. Deleting the search cookie every time, as updated by the master clone, is not really an option :) Since I cannot find the bug where this development was documented, I do not know if this side-effect was discussed, tested etc. But for changes like this, a question like: Can this change affect older Koha versions somehow? would be fine to address at the least.. Thanks, Marcel
op 10-10-13 23:17, Marcel de Rooy schreef:
Recently two commits were added that move the search history cookie to a new format.
commit 961617765ef25bde32cb050ad016f3b063661ef8 (no bug number, from Galen) commit 488a3d6fed57b4e0d773157ee4a6ab7e4775e7a4 (no bug number, from Galen)
If memory serves, these were a security patch, but I can't find an associated bug number (as you found too.) This might be a hint though. Robin.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10657 I think it's unrelated to the bcrypt patches, as they should only affect how we store passwords. Katrin
-----Original Message----- From: koha-devel-bounces@lists.koha-community.org [mailto:koha-devel- bounces@lists.koha-community.org] On Behalf Of Robin Sheat Sent: Thursday, October 10, 2013 12:30 PM To: koha-devel@lists.koha-community.org Subject: Re: [Koha-devel] Crashes on new Opac Recent Searches cookie in older Koha versions
op 10-10-13 23:17, Marcel de Rooy schreef:
Recently two commits were added that move the search history cookie to a new format.
commit 961617765ef25bde32cb050ad016f3b063661ef8 (no bug number, from Galen) commit 488a3d6fed57b4e0d773157ee4a6ab7e4775e7a4 (no bug number, from Galen)
If memory serves, these were a security patch, but I can't find an associated bug number (as you found too.)
This might be a hint though.
Robin.
Hi, On Thu, Oct 10, 2013 at 3:17 AM, Marcel de Rooy <M.de.Rooy@rijksmuseum.nl>wrote:
Recently two commits were added that move the search history cookie to a new format.
**
** **
commit 961617765ef25bde32cb050ad016f3b063661ef8 (no bug number, from Galen)****
commit 488a3d6fed57b4e0d773157ee4a6ab7e4775e7a4 (no bug number, from Galen) ****
** **
I have been looking for these patches on Bugzilla, but I cannot find them. Perhaps they are there, but I may have used the wrong search terms.
As Katrin pointed out, these were part of bug 10657 for the July security release. The patches lack a bug number because of a chicken-and-egg problem, as the bug couldn't be posted before the patches and the release announcement were.
These patches have a nasty side-effect. If you use an older Koha version and also current master on the same system for testing, the old Koha version will stumble over this (shared) cookie:****
** **
Storable binary image v45.123 more recent than I am (v2.8) at /usr/lib64/perl5/Storable.pm line 416, at /usr/share/koha/maintclone/C4/Auth.pm line 293.****
** **
So to overcome this problem, you must delete the KohaOpacRecentSearches cookie AND set preference EnableOpacSearchHistory to off in the old system. ****
Deleting the search cookie every time, as updated by the master clone, is not really an option :)
An alternative configuration which may better suit your needs is to use name-based virtual hosts rather than port-based ones, which will perforce ensure that the two versions don't share cookies.
Since I cannot find the bug where this development was documented, I do not know if this side-effect was discussed, tested etc. ****
But for changes like this, a question like: Can this change affect older Koha versions somehow? would be fine to address at the least..
Considering that the security release was made at the end of July, was targeted at supported *and* unsupported versions, and was heavily publicized, there is already a fair amount of negative data (in the form of no new bug reports that include the keyword "storable") that would indicate that the configuration you use for testing is rarely used by production sites. However, the existence of this thread will hopefully provide hints if anybody else does do use this configuration. Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc@esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org
participants (4)
-
Fischer, Katrin -
Galen Charlton -
Marcel de Rooy -
Robin Sheat