Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a bit more control to what CookieManager does by
adding a hardcoded allowlist of cookie names that are cleared at
logout. Allowing at the same time to add entries to that list by
using koha-conf <remove_cookie> lines or removing entries from the
hardcoded list by using <do_not_remove_cookie> lines.
The patch fixes the expiration of cookies that should be removed
by passing max-age 0.
Also it adds a theoretical path correction for always_show_holds but
since we do not clear that cookie, it is currently unused. This seems
to be the only Koha cookie where we use a longer path.
Test plan:
Run t/CookieManager.t
Go to OPAC, login, select a few OPAC search results and send them
to cart. This would create cookie bib_list. (Check dev tools.)
Logout from OPAC and check cookie in your browser dev tools. What
you see, depends on the browser. But the cookie should be either
gone or empty and expired (FF: Session).
Now add a <do_not_remove_cookie> line for bib_list in koha-conf.
Restart all. Repeat search, add to cart. Logout. Check again in dev
tools that bib_list is not empty, not expired.
Check out an item. And click on 'Always show checkouts...' on
the patron checkout form. This should create the cookie with
value DO. Logout from intranet. Check that cookie was not affected.
Now add a <remove_cookie> line for the following cookie:
issues-table-load-immediately-circulation. Restart all.
Login and logout from staff again. Check that cookie is empty
and expired, or just gone.
Bonus for devs: Create some custom cookie, and test keeping or
removing it similar as above.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is generated using:
% perl misc/devel/tidy.pl
*within* ktd, to get the same version of perltidy than what will be used
by our CI (currently v20230309).
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
As requested by Jonathan, we need more flexibility ;)
Here it comes.
Test plan:
Run t/CookieManager.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This change allows us to add catalogue_editor_ to the deny list
in koha-conf.xml and keep cookies like catalogue_editor_123.
Test plan:
Run t/CookieManager.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
To test:
1 - Sign in to staff client
2 - Search for records and edit one
3 - Switch to advanced editor
4 - View cookies (F12/developer panel/storage tab)
5 - Note cookie like 'catalogue_editor_##' with value 'advanced'
6 - Log out
7 - note cookie value deleted
8 - Log in and search/edit a record
9 - Basic editor loads
10 - Apply patch
11 - Add line to koha-conf as described in second patch
12 - Restart all
13 - Switch to advanced editor
14 - Cookie value updated
15 - Logout
16 - Cookie value remains
17 - Log in and search/edit
18 - Confirm advanced editor loads
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Running Auth.t produces several warnings like:
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 103.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 104.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 112.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 103.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 104.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 112.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 103.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 104.
Use of uninitialized value $name in hash element at /usr/share/koha/Koha/CookieManager.pm line 112.
Test plan:
prove t/CookieManager.t t/db_dependent/Auth.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
See the discussion on the Bugzilla report.
It might be easier to work with a deny list.
Test plan:
Run t/CookieManager.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
Run t/CookieManager.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Tomas Cohen Arazi
Marcel de Rooy
Koha Development Team