Bugzilla – Attachment 50147 Details for
Bug 16210
Bug 15111 breaks the OPAC if JavaScript is disabled
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 16210: Revert OPAC changes from Bug 15111
Bug-16210-Revert-OPAC-changes-from-Bug-15111.patch (text/plain), 3.66 KB, created by
Marc Véron
on 2016-04-12 14:02:27 UTC
(
hide
)
Description:
Bug 16210: Revert OPAC changes from Bug 15111
Filename:
MIME Type:
Creator:
Marc Véron
Created:
2016-04-12 14:02:27 UTC
Size:
3.66 KB
patch
obsolete
>From f8e629299a2da0477fcb740bbab8d9e1bb98e00b Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 8 Apr 2016 10:03:24 +0100 >Subject: [PATCH] Bug 16210: Revert OPAC changes from Bug 15111 >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >This patch reverts the changes made at the OPAC from the following >patches: > >Do not include the antiClickjack legacy browser trick for greybox" > >Revert "Bug 15111: Do not include the antiClickjack legacy browser trick for greybox" >This reverts commit fc640d2a86f395ad392f84314bce22e8b4dab1fe. > >Revert "Bug 15111: Change X-Frame-Options with SAMEORIGIN" >This reverts commit fb167c0e4b897bf9a93b4fd6176b15e2d4dbd4df. > >Revert "Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks" >This reverts commit dc03bca76cf5b7cb48d98d1ce245fc65b98be929. > >Setting X-Frame-Options to SAMEORIGIN is enough for mordern browsers: >https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options > >The antiClickjack trick should be removed at the OPAC as we want to keep >the OPAC usable even if the user has disabled JS. >That means the OPAC will be vulnerable to XFS if a user is navigating >with a prehistoric browser: >Firefox 3.6.9 September 2010 >IE 8 March 2008 >Opera 10.5 March 2010 >Safari 4 February 2009 >Chrome 4.1.⦠somewhen 2010 > >Test plan: >Confirm that there are no regression of bug 15111 with modern browsers > >Signed-off-by: Marc Véron <veron@veron.ch> >--- > .../opac-tmpl/bootstrap/en/includes/doc-head-close.inc | 14 -------------- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt | 2 +- > 2 files changed, 1 insertion(+), 15 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc >index 54cf6c7..e346689 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc >@@ -1,20 +1,6 @@ > <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> > <meta name="generator" content="Koha [% Version %]" /> <!-- leave this for stats --> > <meta name="viewport" content="width=device-width, initial-scale=1" /> >- >-[%# Prevent XFS attacks -%] >-[% UNLESS popup %] >- <style id="antiClickjack">body{display:none !important;}</style> >- <script type="text/javascript"> >- if (self === top) { >- var antiClickjack = document.getElementById("antiClickjack"); >- antiClickjack.parentNode.removeChild(antiClickjack); >- } else { >- top.location = self.location; >- } >- </script> >-[% END %] >- > <link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" /> > [% IF ( bidi ) %] > <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/lib/bootstrap/css/bootstrap-rtl.min.css" /> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt >index fdb1d72..4db0d1a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt >@@ -1,7 +1,7 @@ > [% INCLUDE 'doc-head-open.inc' %] > <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › Your search IDREF for ppn [% unimarc3 %]</title> > <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> >-[% INCLUDE 'doc-head-close.inc' popup => 1 %] >+[% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] > <style type="text/css"> > ul.ui-tabs-nav li a, ul.ui-tabs-nav li span.a { padding:0.6em 1em; } >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16210
:
50051
|
50052
|
50147
|
50148
|
50220
|
50221