Bugzilla – Attachment 130005 Details for
Bug 29957
Cookies not removed after logout
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29957: Clear cookies on logout
Bug-29957-Clear-cookies-on-logout.patch (text/plain), 6.60 KB, created by
Martin Renvoize (ashimema)
on 2022-01-31 14:08:43 UTC
(
hide
)
Description:
Bug 29957: Clear cookies on logout
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-01-31 14:08:43 UTC
Size:
6.60 KB
patch
obsolete
>From 255e1791dafdd1452b4c40a48c7995dd787db34f Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 27 Jan 2022 12:33:57 +0100 >Subject: [PATCH] Bug 29957: Clear cookies on logout > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/Auth.pm | 50 ++++++++++++++++++++++++++++---------------------- > 1 file changed, 28 insertions(+), 22 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index dd7d24b1f1..abcd0e6b5c 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -152,7 +152,7 @@ Output.pm module. > sub get_template_and_user { > > my $in = shift; >- my ( $user, $cookie, $sessionID, $flags ); >+ my ( $user, $cookies, $sessionID, $flags ); > > # Get shibboleth login attribute > my $shib = C4::Context->config('useshibboleth') && shib_ok(); >@@ -170,7 +170,7 @@ sub get_template_and_user { > ); > > if ( $in->{'template_name'} !~ m/maintenance/ ) { >- ( $user, $cookie, $sessionID, $flags ) = checkauth( >+ ( $user, $cookies, $sessionID, $flags ) = checkauth( > $in->{'query'}, > $in->{'authnotrequired'}, > $in->{'flagsrequired'}, >@@ -192,7 +192,7 @@ sub get_template_and_user { > given_on => { '!=', undef }, > })->next; > if( !$consent ) { >- print $in->{query}->redirect(-uri => '/cgi-bin/koha/opac-patron-consent.pl', -cookie => $cookie); >+ print $in->{query}->redirect(-uri => '/cgi-bin/koha/opac-patron-consent.pl', -cookie => $cookies); > safe_exit; > } > } >@@ -230,7 +230,7 @@ sub get_template_and_user { > if ($kick_out) { > $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', > $in->{query} ); >- $cookie = $in->{query}->cookie( >+ push @$cookies, $in->{query}->cookie( > -name => 'CGISESSID', > -value => '', > -expires => '', >@@ -247,7 +247,7 @@ sub get_template_and_user { > { > type => 'text/html', > charset => 'utf-8', >- cookie => $cookie, >+ cookie => $cookies, > 'X-Frame-Options' => 'SAMEORIGIN' > } > ), >@@ -638,14 +638,10 @@ sub get_template_and_user { > # what to do > my $language = C4::Languages::getlanguage( $in->{'query'} ); > my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language ); >- if ( ref $cookie eq 'ARRAY' ) { >- push @{$cookie}, $languagecookie; >- } else { >- $cookie = [ $cookie, $languagecookie ]; >- } >+ push @{$cookies}, $languagecookie; > } > >- return ( $template, $borrowernumber, $cookie, $flags ); >+ return ( $template, $borrowernumber, $cookies, $flags ); > } > > =head2 checkauth >@@ -792,6 +788,15 @@ sub _timeout_syspref { > return $timeout; > } > >+sub clear_all_cookies { >+ my ( $query ) = shift; >+ my @cookies; >+ for my $cookie_name ( $query->cookie ) { >+ push @cookies, $query->cookie( -name => $cookie_name, -value => '', -expires => '', -HttpOnly => 1 ); >+ } >+ return \@cookies; >+} >+ > sub checkauth { > my $query = shift; > >@@ -827,9 +832,9 @@ sub checkauth { > # state variables > my $loggedin = 0; > my %info; >- my ( $userid, $cookie, $sessionID, $flags ); >+ my ( $userid, $sessionID, $flags ); >+ my $cookies = []; > my $logout = $query->param('logout.x'); >- > my $anon_search_history; > my $cas_ticket = ''; > # This parameter is the name of the CAS server we want to authenticate against, >@@ -851,7 +856,7 @@ sub checkauth { > if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { > > # Using Basic Authentication, no cookies required >- $cookie = $query->cookie( >+ push @$cookies, $query->cookie( > -name => 'CGISESSID', > -value => '', > -expires => '', >@@ -894,6 +899,7 @@ sub checkauth { > my $shibSuccess = C4::Context->userenv->{'shibboleth'}; > $session->delete(); > $session->flush; >+ $cookies = clear_all_cookies($query); > C4::Context->_unset_userenv($sessionID); > > if ($cas and $caslogout) { >@@ -906,7 +912,7 @@ sub checkauth { > } > } else { > >- $cookie = $query->cookie( >+ push @$cookies, $query->cookie( > -name => 'CGISESSID', > -value => $session->id, > -HttpOnly => 1, >@@ -952,7 +958,7 @@ sub checkauth { > > $sessionID = $session->id; > C4::Context->_new_userenv($sessionID); >- $cookie = $query->cookie( >+ push @$cookies, $query->cookie( > -name => 'CGISESSID', > -value => $sessionID, > -HttpOnly => 1, >@@ -1152,7 +1158,7 @@ sub checkauth { > $domain =~ s|\.\*||g; > if ( $ip !~ /^$domain/ ) { > $loggedin = 0; >- $cookie = $query->cookie( >+ push @$cookies, $query->cookie( > -name => 'CGISESSID', > -value => '', > -HttpOnly => 1, >@@ -1232,8 +1238,8 @@ sub checkauth { > if ( $loggedin || $authnotrequired ) > { > # successful login >- unless ($cookie) { >- $cookie = $query->cookie( >+ unless (@$cookies) { >+ push @$cookies, $query->cookie( > -name => 'CGISESSID', > -value => '', > -HttpOnly => 1, >@@ -1251,11 +1257,11 @@ sub checkauth { > $uri->query_param_delete('userid'); > $uri->query_param_delete('password'); > $uri->query_param_delete('koha_login_context'); >- print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other'); >+ print $query->redirect(-uri => $uri->as_string, -cookie => $cookies, -status=>'303 See other'); > exit; > } > >- return ( $userid, $cookie, $sessionID, $flags ); >+ return ( $userid, $cookies, $sessionID, $flags ); > } > > # >@@ -1389,7 +1395,7 @@ sub checkauth { > print $query->header( > { type => 'text/html', > charset => 'utf-8', >- cookie => $cookie, >+ cookie => $cookies, > 'X-Frame-Options' => 'SAMEORIGIN' > } > ), >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29957
:
129871
|
129872
|
130005
|
130006
|
131428
|
131750
|
131751
|
131752
|
131807
|
131808
|
131809
|
131810
|
131824
|
131825
|
131826
|
131827
|
131828
|
131840
|
131841
|
131842
|
131843
|
131856
|
132045
|
132046
|
132047
|
132105
|
132106
|
132107
|
132108
|
132109
|
132110
|
132111
|
132115
|
132210
|
132211
|
132231
|
132232
|
132233
|
132234
|
132235
|
132236
|
132237
|
132238
|
132239
|
132288
|
132289
|
132290
|
132291
|
132292
|
132293
|
132294
|
132295
|
132296