Received via email: --------------- I also just discovered that the system preference SelfCheckTimeout which says it's supposed to "Time our the current patron's web-based self checkout system login" after a certain number of second only really returns to the self-check login screen. It's still possible to navigate back, see previous patron checkouts and check out items. ----------- Found in Koha 3.10.3
Confirmed in master.
Telling the browser not to cache self-check pages should resolve this
(In reply to Galen Charlton from comment #2) > Telling the browser not to cache self-check pages should resolve this It does already use a no-cache Cache-control directive; some preliminary testing indicates that adding max-age=0 to the cache-control directive should do it. Working on a patch.
Created attachment 22115 [details] [review] bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 22116 [details] [review] Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 22117 [details] [review] bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
I tested this bug in both Chrome and Firefox 24 (on a mac). It worked in Chrome but in firefox I got the following error when doing step 4 of the test plan. http://edveal.test.bywatersolutions.com/cgi-bin/koha/sco/undefined An error has occurred Error 404 This error means that the link was broken and that the page doesn't exist. To report this error, you can email the Koha Administrator. Return to the catalog home page. Ed
Created attachment 22126 [details] [review] Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 22127 [details] [review] bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 22129 [details] [review] [SIGN-OFF]bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Created attachment 22130 [details] [review] Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Created attachment 22131 [details] [review] Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Created attachment 22132 [details] [review] [SIGN-OFF]bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Created attachment 22140 [details] [review] [PASSED-QA] Bug 10016: force zero browser-side caching of SCO pages This patch makes the web-based self-check module pages specify that no browser (or proxy caching) occur at all. This prevents a security issue where letting the SCO session time out, then hitting the back button allowed one to view the previous patron's session. This patch adds an optional fifth parameter to output_with_http_headers(), and output_html_with_http_headers(), a hashref for miscellaneous options. One key is defined at the moment: force_no_caching, which if if present and set to a true value, sets HTTP headers to specify no browser caching of the page at all. To test: [1] Start a web-based self-check session and optionally perform some transactions. [2] Allow the session to time out (it may be helpful to set SelfCheckTimeout to a low value such as 10 seconds). [3] Hit the back button. You should not see the previous patron's self-check session. [4] Verify that prove -v t/Output.t passes. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Created attachment 22141 [details] [review] [PASSED-QA] bug 10016: munge history in SCO to discourage resubmitting user login This patch uses history.replaceState (introduced in HTML5) to manipulate the browser history to encourage returning to the SCO patron barcode form if the back button is used. Note that a side effect of this patch is that if the user uses the help link, they will be prompted to enter their barcode again. It may be better to put the help inline with the rest of the SCO forms. To test: [1] Start a web-based self-check session. [2] Enter a patron barcode. [3] Allow the self-check session to time out. [4] Use the back button. You should get the patron barcode entry form; you should not be prompted to resubmit form input. [5] Enter a patron barcode, perform some transactions, then use the finish button. [6] Next, use the back button. You should get the patron barcode entry form. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Pushed to master.
This patch has been pushed to 3.12.x, will be in 3.12.7. Thanks Galen!