Bugzilla – Attachment 131842 Details for
Bug 29957
Cookies not removed after logout
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29957: Adjust push @$cookie statements in Auth
Bug-29957-Adjust-push-cookie-statements-in-Auth.patch (text/plain), 5.67 KB, created by
Marcel de Rooy
on 2022-03-17 13:24:52 UTC
(
hide
)
Description:
Bug 29957: Adjust push @$cookie statements in Auth
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-03-17 13:24:52 UTC
Size:
5.67 KB
patch
obsolete
>From 7462f698fab31fe1061f6224c36c789e9f3fa5cd Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Wed, 16 Mar 2022 12:43:07 +0000 >Subject: [PATCH] Bug 29957: Adjust push @$cookie statements in Auth >Content-Type: text/plain; charset=utf-8 > >We can now use $cookie_mgr->replace_in_list instead. This >effectively removes duplicates and keeps the newest cookie. > >Test plan: >Run t/db_dependent/Auth.t >Add removable_cookie entries in koha-conf for: > form_serialized, form_serialized_limits >(Note: these are js cookies, no httponly flag.) >Login at OPAC. >If you are using the same domain, check if you are logged in on the >staff client too. >Go back to OPAC, perform an Advanced search. >Check cookies on browser dev console. Look for the 2 form_ cookies. >Go to staff. Logout >Go to OPAC. Check cookies in dev console. Are you logged out? >Login at staff again. Hit some pages in the staff client and verify >that they respond as expected. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Auth.pm | 30 +++++++++++++++--------------- > 1 file changed, 15 insertions(+), 15 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index e690fc473d..d5ee7d9573 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -156,6 +156,8 @@ sub get_template_and_user { > my ( $user, $cookie, $sessionID, $flags ); > $cookie = []; > >+ my $cookie_mgr = Koha::CookieManager->new; >+ > # Get shibboleth login attribute > my $shib = C4::Context->config('useshibboleth') && shib_ok(); > my $shib_login = $shib ? get_login_shib() : undef; >@@ -244,13 +246,12 @@ sub get_template_and_user { > if ($kick_out) { > $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', > $in->{query} ); >- push @$cookie, $in->{query}->cookie( >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $in->{query}->cookie( > -name => 'CGISESSID', > -value => '', >- -expires => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- ); >+ )); > > $template->param( > loginprompt => 1, >@@ -656,7 +657,7 @@ sub get_template_and_user { > # what to do > my $language = C4::Languages::getlanguage( $in->{'query'} ); > my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language ); >- push @{$cookie}, $languagecookie; >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); > } > > return ( $template, $borrowernumber, $cookie, $flags ); >@@ -868,13 +869,12 @@ sub checkauth { > if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { > > # Using Basic Authentication, no cookies required >- push @$cookie, $query->cookie( >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( > -name => 'CGISESSID', > -value => '', >- -expires => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- ); >+ )); > $loggedin = 1; > } > elsif ( $emailaddress) { >@@ -924,12 +924,12 @@ sub checkauth { > } > } else { > >- push @$cookie, $query->cookie( >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( > -name => 'CGISESSID', > -value => $session->id, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- ); >+ )); > > my $sessiontype = $session->param('sessiontype') || ''; > unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... >@@ -970,12 +970,12 @@ sub checkauth { > > $sessionID = $session->id; > C4::Context->_new_userenv($sessionID); >- push @$cookie, $query->cookie( >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( > -name => 'CGISESSID', > -value => $sessionID, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- ); >+ )); > my $pki_field = C4::Context->preference('AllowPKIAuth'); > if ( !defined($pki_field) ) { > print STDERR "ERROR: Missing system preference AllowPKIAuth.\n"; >@@ -1170,12 +1170,12 @@ sub checkauth { > $domain =~ s|\.\*||g; > if ( $ip !~ /^$domain/ ) { > $loggedin = 0; >- push @$cookie, $query->cookie( >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( > -name => 'CGISESSID', > -value => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- ); >+ )); > $info{'wrongip'} = 1; > } > } >@@ -1258,12 +1258,12 @@ sub checkauth { > { > # successful login > unless (@$cookie) { >- push @$cookie, $query->cookie( >+ $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( > -name => 'CGISESSID', > -value => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- ); >+ )); > } > > track_login_daily( $userid ); >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29957
:
129871
|
129872
|
130005
|
130006
|
131428
|
131750
|
131751
|
131752
|
131807
|
131808
|
131809
|
131810
|
131824
|
131825
|
131826
|
131827
|
131828
|
131840
|
131841
|
131842
|
131843
|
131856
|
132045
|
132046
|
132047
|
132105
|
132106
|
132107
|
132108
|
132109
|
132110
|
132111
|
132115
|
132210
|
132211
|
132231
|
132232
|
132233
|
132234
|
132235
|
132236
|
132237
|
132238
|
132239
|
132288
|
132289
|
132290
|
132291
|
132292
|
132293
|
132294
|
132295
|
132296