Bug 23526 - Shibboleth login url with query has double encoded '?' %3F
Summary: Shibboleth login url with query has double encoded '?' %3F
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-30 17:16 UTC by Nick Clemens (kidclamp)
Modified: 2020-06-04 20:34 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.04
Circulation function:

Attachments
Bug 23526: Don't use encoded question mark in shib_login_url (1.02 KB, patch)
2019-09-10 16:46 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Bug 23526: Don't use encoded question mark in shib_login_url (1.08 KB, patch)
2019-09-18 13:23 UTC, Matthias Meusburger 		Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2019-08-30 17:16:06 UTC 
In login_shib_url we place an encoded '?' into the login url:
 65     if ( $query->query_string() ) {
 66         $param = $param . '%3F' . $query->query_string();
 67     }

Then in the templates we filter that using the URL filter:
<p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl | url %]">click here to login</a>.</p>


The URL filter turns the % into %25 and the string comes out as
https://anykoha.bywatersolutions.com/Shibboleth.sso/Login?target=https://anykoha.bywatersolutions.com/cgi-bin/koha/opac-search.pl%253Fq=cats

This returns a 4040 on successful login
Comment 1 Nick Clemens (kidclamp) 2019-09-10 16:46:41 UTC 
Created attachment 92699 [details] [review]
Bug 23526: Don't use encoded question mark in shib_login_url

To test:
1 - Enable shib
2 - Do a search
3 - Try to login from search
4 - Get an error
5 - Apply patch
6 - Retry

Note: You don't haveto really enable shib, you can simply enable it in koha-conf.xml and check the URLs
Comment 2 Matthias Meusburger 2019-09-18 13:23:50 UTC 
Created attachment 92939 [details] [review]
Bug 23526: Don't use encoded question mark in shib_login_url

To test:
1 - Enable shib
2 - Do a search
3 - Try to login from search
4 - Get an error
5 - Apply patch
6 - Retry

Note: You don't haveto really enable shib, you can simply enable it in koha-conf.xml and check the URLs
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Comment 3 Katrin Fischer 2019-09-22 10:28:59 UTC 
I am moving this PQA as the change is tiny and I trust Nick and Matthias. Also our RM is a Shibboleth pro.
Comment 4 Martin Renvoize (ashimema) 2019-09-23 09:44:27 UTC 
Nice work!

Pushed to master for 19.11.00
Comment 5 Fridolin Somers 2019-09-24 06:59:51 UTC 
Pushed to 19.05.x for 19.05.04
Comment 6 Fridolin Somers 2019-09-24 07:45:44 UTC 
Oh but UT needs to be fixed :

Auth_with_shibboleth.t "login shib url" calls :

is(
    login_shib_url($query),
    'https://testopac.com'
      . '/Shibboleth.sso/Login?target='
      . 'https://testopac.com/cgi-bin/koha/opac-user.pl' . '%3F'
      . $query_string,
    "login shib url"
);
Comment 7 Fridolin Somers 2019-09-24 08:00:17 UTC 
(In reply to Fridolin SOMERS from comment #6)
> Oh but UT needs to be fixed :
> 
> Auth_with_shibboleth.t "login shib url" calls :
> 
> is(
>     login_shib_url($query),
>     'https://testopac.com'
>       . '/Shibboleth.sso/Login?target='
>       . 'https://testopac.com/cgi-bin/koha/opac-user.pl' . '%3F'
>       . $query_string,
>     "login shib url"
> );

Corrected by : 
Bug 23526: (RM follow-up) Fix failing test

Perfect ﷐[U+1F44C]﷑
Comment 8 Lucas Gass (lukeg) 2019-10-17 19:36:01 UTC 
backported to 18.11.x for 18.11.11