If any share button is active on the details page to some media (must not necessarily be the Twitter button), then requests are sent to Twitter which contain information about the currently displayed media in the referer header Example: .../cgi-bin/koha/opac-detail.pl?biblionumber=21&query_desc=kw%2Cwrdl%3A%20sch*). This is not acceptable from a data privacy point of view. Instead of using the Twitter script a simple link behind the Twitter share button should be used (as already done e.g. for sharing with Facebook or LinkedIn).
Created attachment 108824 [details] [review] Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter
(In reply to Jonathan Druart from comment #1) > Click on the twitter button and confirm that the link only contain > biblionumber=x in the parameter I'm still getting the "query_desc" part of the URL: https://twitter.com/intent/tweet?url=http%3A%2F%2F127.0.0.1%3A8080%2Fcgi-bin%2Fkoha%2Fopac-detail.pl%3Fbiblionumber%3D2358%26query_desc%3Dkw%252Cwrdl%253A%2520bark
Adjusting the URL used for the Twitter link will not solve the issue. As long as the following script-tag <script id="twitter-wjs" src="//platform.twitter.com/widgets.js"></script> is part of the page there will be (a dark) request to Twitter which contains the number of the displayed media in the referer header.
Created attachment 108832 [details] [review] Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter
Created attachment 109121 [details] [review] Bug 26069: Pass correct URL to twitter Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter
Created attachment 109206 [details] [review] Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(In reply to x.schindel from comment #3) Can you confirm it now works as you expected?
I verified it using the dev tools in the broswer - I saw the request to Twitter without the patch, but not with it.
I applied the patch on my development machine and it's worked OK.
Pushed to master for 20.11, thanks to everybody involved!
backported to 20.05.x for 20.05.04
*** Bug 24520 has been marked as a duplicate of this bug. ***
backported to 19.11.x for 19.11.10
Backported to 19.05.x branch for 19.05.15 (triple checked that the strings were untouched)