From 255e1791dafdd1452b4c40a48c7995dd787db34f Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 27 Jan 2022 12:33:57 +0100 Subject: [PATCH] Bug 29957: Clear cookies on logout Signed-off-by: Martin Renvoize --- C4/Auth.pm | 50 ++++++++++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index dd7d24b1f1..abcd0e6b5c 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -152,7 +152,7 @@ Output.pm module. sub get_template_and_user { my $in = shift; - my ( $user, $cookie, $sessionID, $flags ); + my ( $user, $cookies, $sessionID, $flags ); # Get shibboleth login attribute my $shib = C4::Context->config('useshibboleth') && shib_ok(); @@ -170,7 +170,7 @@ sub get_template_and_user { ); if ( $in->{'template_name'} !~ m/maintenance/ ) { - ( $user, $cookie, $sessionID, $flags ) = checkauth( + ( $user, $cookies, $sessionID, $flags ) = checkauth( $in->{'query'}, $in->{'authnotrequired'}, $in->{'flagsrequired'}, @@ -192,7 +192,7 @@ sub get_template_and_user { given_on => { '!=', undef }, })->next; if( !$consent ) { - print $in->{query}->redirect(-uri => '/cgi-bin/koha/opac-patron-consent.pl', -cookie => $cookie); + print $in->{query}->redirect(-uri => '/cgi-bin/koha/opac-patron-consent.pl', -cookie => $cookies); safe_exit; } } @@ -230,7 +230,7 @@ sub get_template_and_user { if ($kick_out) { $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} ); - $cookie = $in->{query}->cookie( + push @$cookies, $in->{query}->cookie( -name => 'CGISESSID', -value => '', -expires => '', @@ -247,7 +247,7 @@ sub get_template_and_user { { type => 'text/html', charset => 'utf-8', - cookie => $cookie, + cookie => $cookies, 'X-Frame-Options' => 'SAMEORIGIN' } ), @@ -638,14 +638,10 @@ sub get_template_and_user { # what to do my $language = C4::Languages::getlanguage( $in->{'query'} ); my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language ); - if ( ref $cookie eq 'ARRAY' ) { - push @{$cookie}, $languagecookie; - } else { - $cookie = [ $cookie, $languagecookie ]; - } + push @{$cookies}, $languagecookie; } - return ( $template, $borrowernumber, $cookie, $flags ); + return ( $template, $borrowernumber, $cookies, $flags ); } =head2 checkauth @@ -792,6 +788,15 @@ sub _timeout_syspref { return $timeout; } +sub clear_all_cookies { + my ( $query ) = shift; + my @cookies; + for my $cookie_name ( $query->cookie ) { + push @cookies, $query->cookie( -name => $cookie_name, -value => '', -expires => '', -HttpOnly => 1 ); + } + return \@cookies; +} + sub checkauth { my $query = shift; @@ -827,9 +832,9 @@ sub checkauth { # state variables my $loggedin = 0; my %info; - my ( $userid, $cookie, $sessionID, $flags ); + my ( $userid, $sessionID, $flags ); + my $cookies = []; my $logout = $query->param('logout.x'); - my $anon_search_history; my $cas_ticket = ''; # This parameter is the name of the CAS server we want to authenticate against, @@ -851,7 +856,7 @@ sub checkauth { if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { # Using Basic Authentication, no cookies required - $cookie = $query->cookie( + push @$cookies, $query->cookie( -name => 'CGISESSID', -value => '', -expires => '', @@ -894,6 +899,7 @@ sub checkauth { my $shibSuccess = C4::Context->userenv->{'shibboleth'}; $session->delete(); $session->flush; + $cookies = clear_all_cookies($query); C4::Context->_unset_userenv($sessionID); if ($cas and $caslogout) { @@ -906,7 +912,7 @@ sub checkauth { } } else { - $cookie = $query->cookie( + push @$cookies, $query->cookie( -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, @@ -952,7 +958,7 @@ sub checkauth { $sessionID = $session->id; C4::Context->_new_userenv($sessionID); - $cookie = $query->cookie( + push @$cookies, $query->cookie( -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, @@ -1152,7 +1158,7 @@ sub checkauth { $domain =~ s|\.\*||g; if ( $ip !~ /^$domain/ ) { $loggedin = 0; - $cookie = $query->cookie( + push @$cookies, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, @@ -1232,8 +1238,8 @@ sub checkauth { if ( $loggedin || $authnotrequired ) { # successful login - unless ($cookie) { - $cookie = $query->cookie( + unless (@$cookies) { + push @$cookies, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, @@ -1251,11 +1257,11 @@ sub checkauth { $uri->query_param_delete('userid'); $uri->query_param_delete('password'); $uri->query_param_delete('koha_login_context'); - print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other'); + print $query->redirect(-uri => $uri->as_string, -cookie => $cookies, -status=>'303 See other'); exit; } - return ( $userid, $cookie, $sessionID, $flags ); + return ( $userid, $cookies, $sessionID, $flags ); } # @@ -1389,7 +1395,7 @@ sub checkauth { print $query->header( { type => 'text/html', charset => 'utf-8', - cookie => $cookie, + cookie => $cookies, 'X-Frame-Options' => 'SAMEORIGIN' } ), -- 2.20.1