Bugzilla – Attachment 183443 Details for
Bug 40224
Replace use of location.href with POST logout form
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40224: Replace use of location.href with POST logout form
Bug-40224-Replace-use-of-locationhref-with-POST-lo.patch (text/plain), 6.39 KB, created by
Kyle M Hall (khall)
on 2025-06-24 11:30:11 UTC
(
hide
)
Description:
Bug 40224: Replace use of location.href with POST logout form
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2025-06-24 11:30:11 UTC
Size:
6.39 KB
patch
obsolete
>From efddbf26044ad09aaf8048baecaae06b1e730a8d Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Tue, 24 Jun 2025 07:27:26 -0400 >Subject: [PATCH] Bug 40224: Replace use of location.href with POST logout form > >The self-check module should use use POST for logouts instead of GET. > >Test Plan: >1) Enable WebBasedSelfCheck and SelfCheckInModule >2) Set SelfCheckTimeout and SelfCheckInTimeout to 10 seconds >3) Log in to each, observer the page is logged out after 10 seconds > with not "op=logout" in the URL. Wait another 10 seconds, observe the > page again refreshes with no "op=logout" in the URL. >--- > .../bootstrap/en/modules/sci/sci-main.tt | 9 +++++++-- > .../bootstrap/en/modules/sco/sco-main.tt | 18 ++++++++++++------ > koha-tmpl/opac-tmpl/bootstrap/js/timeout.js | 14 ++++++-------- > opac/sco/sco-main.pl | 3 +-- > 4 files changed, 26 insertions(+), 18 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >index 157752faa6b..73984fc16fa 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >@@ -198,6 +198,11 @@ > </div> <!-- /.modal-dialog --> > </div> <!-- /#helpModal --> > >+<form action="/cgi-bin/koha/sco/sco-main.pl" id="logout_post_form" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-logout" /> >+</form> >+ > </body> > > [% INCLUDE 'opac-bottom.inc' %] >@@ -286,8 +291,8 @@ > const home_href = "/cgi-bin/koha/sci/sci-main.pl"; > const sci_timer = new sc_timer({ > "idle_timeout": idleTimeout, >- "redirect_url": home_href >- }); >+ "form_id": "logout_post_form", >+ }); > window.sci_login_timer = sci_timer; > sci_timer.start_timer(); > } >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >index 81ed4bfef73..0ff43bc2de0 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >@@ -526,8 +526,14 @@ > </div> <!-- / .row --> > </div> <!-- / .container-fluid --> > </div> <!-- / .main --> >+ > <span id="audio-alert"></span> > >+ <form action="/cgi-bin/koha/sco/sco-main.pl" id="logout_post_form" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-logout" /> >+ </form> >+ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >@@ -547,10 +553,10 @@ > //NOTE: There can only be 1 sco_login_timer at a time > if ( ! window.sco_login_timer ){ > const idleTimeout = "[% Koha.Preference('SelfCheckTimeout') || 120 | html %]"; >- const home_href = "/cgi-bin/koha/sco/sco-main.pl?op=logout"; >+ const home_href = "/cgi-bin/koha/sco/sco-main.pl"; > const sco_timer = new sc_timer({ > "idle_timeout": idleTimeout, >- "redirect_url": home_href >+ "form_id": "logout_post_form", > }); > window.sco_login_timer = sco_timer; > sco_timer.start_timer(); >@@ -571,7 +577,7 @@ > // alert("checkout_confirm('" + patronid + "') called for barcode '" + barcode + "'"); > if (! barcode) { dofocus(); return false; } // no barcode > if (barcode == "__KOHA_NEW_CIRC__") { // magic barcode >- window.location.href='/cgi-bin/koha/sco/sco-main.pl?op=logout'; >+ $("#logout_post_form").submit(); > return false; > } > return true; >@@ -645,13 +651,13 @@ > confirmModal("", _("Would you like to print a receipt?"), _("Print receipt and end session"), _("End session"), function(result) { > if ( result && (Date.now() - confirmStart) < [% Koha.Preference('SelfCheckTimeout') | html %] ) { > var win = window.open("/cgi-bin/koha/sco/printslip.pl?print=qslip"); >- location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout'; >+ $("#logout_post_form").submit(); > } else { >- location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout'; >+ $("#logout_post_form").submit(); > } > }) > [% ELSE %] >- location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout'; >+ $("#logout_post_form").submit(); > [% END %] > > return true; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js b/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js >index 6c508d14c07..fe5d28abe33 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js >+++ b/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js >@@ -1,13 +1,11 @@ > class sc_timer { > constructor(args) { > const idle_timeout = args["idle_timeout"]; >- const redirect_url = args["redirect_url"]; >- if (idle_timeout) { >- this.idle_timeout = idle_timeout; >- } >- if (redirect_url) { >- this.redirect_url = redirect_url; >- } >+ const form_id = args["form_id"]; >+ >+ this.idle_timeout = idle_timeout; >+ this.form_id = form_id; >+ > this.idle_time = 0; > } > >@@ -33,7 +31,7 @@ class sc_timer { > _timer_increment() { > this.idle_time++; > if (this.idle_time >= this.idle_timeout) { >- location.href = this.redirect_url; >+ $("#" + this.form_id).submit(); > } > } > } >diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl >index e1cc93d8026..939262410eb 100755 >--- a/opac/sco/sco-main.pl >+++ b/opac/sco/sco-main.pl >@@ -93,8 +93,7 @@ my ( $op, $patronlogin, $patronpw, $barcodestr, $confirmed, $newissues, $load_ch > > my $jwt = $query->cookie('JWT'); > >-#FIXME: This needs to be changed to a POSTed logout... >-if ( $op eq "logout" ) { >+if ( $op eq "cud-logout" ) { > $template->param( loggedout => 1 ); > $query->param( patronlogin => undef, patronpw => undef ); > undef $jwt; >-- >2.39.5 (Apple Git-154)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40224
: 183443