View | Details | Raw Unified | Return to bug 26019
Collapse All | Expand All

(-)a/C4/Auth.pm (-1 / +10 lines)
Lines 248-253 sub get_template_and_user { Link Here
248
                -expires  => '',
248
                -expires  => '',
249
                -HttpOnly => 1,
249
                -HttpOnly => 1,
250
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
250
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
251
                -sameSite => 'Lax'
251
            );
252
            );
252
253
253
            $template->param(
254
            $template->param(
Lines 873-878 sub checkauth { Link Here
873
            -expires  => '',
874
            -expires  => '',
874
            -HttpOnly => 1,
875
            -HttpOnly => 1,
875
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
876
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
877
            -sameSite => 'Lax'
876
        );
878
        );
877
        $loggedin = 1;
879
        $loggedin = 1;
878
    }
880
    }
Lines 927-932 sub checkauth { Link Here
927
                    -value    => $session->id,
929
                    -value    => $session->id,
928
                    -HttpOnly => 1,
930
                    -HttpOnly => 1,
929
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
931
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
932
                    -sameSite => 'Lax'
930
                );
933
                );
931
934
932
                my $sessiontype = $session->param('sessiontype') || '';
935
                my $sessiontype = $session->param('sessiontype') || '';
Lines 973-978 sub checkauth { Link Here
973
            -value    => $sessionID,
976
            -value    => $sessionID,
974
            -HttpOnly => 1,
977
            -HttpOnly => 1,
975
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
978
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
979
            -sameSite => 'Lax'
976
        );
980
        );
977
        my $pki_field = C4::Context->preference('AllowPKIAuth');
981
        my $pki_field = C4::Context->preference('AllowPKIAuth');
978
        if ( !defined($pki_field) ) {
982
        if ( !defined($pki_field) ) {
Lines 1173-1178 sub checkauth { Link Here
1173
                                -value    => '',
1177
                                -value    => '',
1174
                                -HttpOnly => 1,
1178
                                -HttpOnly => 1,
1175
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1179
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1180
                                -sameSite => 'Lax'
1176
                            );
1181
                            );
1177
                            $info{'wrongip'} = 1;
1182
                            $info{'wrongip'} = 1;
1178
                        }
1183
                        }
Lines 1261-1266 sub checkauth { Link Here
1261
                -value    => '',
1266
                -value    => '',
1262
                -HttpOnly => 1,
1267
                -HttpOnly => 1,
1263
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1268
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1269
                -sameSite => 'Lax'
1264
            );
1270
            );
1265
        }
1271
        }
1266
1272
Lines 1413-1419 sub checkauth { Link Here
1413
        {   type              => 'text/html',
1419
        {   type              => 'text/html',
1414
            charset           => 'utf-8',
1420
            charset           => 'utf-8',
1415
            cookie            => $cookie,
1421
            cookie            => $cookie,
1416
            'X-Frame-Options' => 'SAMEORIGIN'
1422
            'X-Frame-Options' => 'SAMEORIGIN',
1423
            -sameSite => 'Lax'
1417
        }
1424
        }
1418
      ),
1425
      ),
1419
      $template->output;
1426
      $template->output;
Lines 1496-1501 sub check_api_auth { Link Here
1496
            -value    => $session->id,
1503
            -value    => $session->id,
1497
            -HttpOnly => 1,
1504
            -HttpOnly => 1,
1498
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1505
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1506
            -sameSite => 'Lax'
1499
        );
1507
        );
1500
        return ( $return, undef, $session );
1508
        return ( $return, undef, $session );
1501
1509
Lines 1536-1541 sub check_api_auth { Link Here
1536
                -value    => $sessionID,
1544
                -value    => $sessionID,
1537
                -HttpOnly => 1,
1545
                -HttpOnly => 1,
1538
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1546
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1547
                -sameSite => 'Lax'
1539
            );
1548
            );
1540
            if ( $return == 1 ) {
1549
            if ( $return == 1 ) {
1541
                my (
1550
                my (
(-)a/C4/InstallAuth.pm (+4 lines)
Lines 262-267 sub checkauth { Link Here
262
                -value    => $session->id,
262
                -value    => $session->id,
263
                -HttpOnly => 1,
263
                -HttpOnly => 1,
264
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
264
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
265
                -sameSite => 'Lax'
265
            );
266
            );
266
            $loggedin = 1;
267
            $loggedin = 1;
267
            $userid   = $session->param('cardnumber');
268
            $userid   = $session->param('cardnumber');
Lines 302-307 sub checkauth { Link Here
302
                -value    => $sessionID,
303
                -value    => $sessionID,
303
                -HttpOnly => 1,
304
                -HttpOnly => 1,
304
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
305
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
306
                -sameSite => 'Lax'
305
            );
307
            );
306
            if ( $return == 2 ) {
308
            if ( $return == 2 ) {
307
309
Lines 349-354 sub checkauth { Link Here
349
                -HttpOnly => 1,
351
                -HttpOnly => 1,
350
                -expires => '',
352
                -expires => '',
351
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
353
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
354
                -sameSite => 'Lax'
352
            );
355
            );
353
        }
356
        }
354
        if ($envcookie) {
357
        if ($envcookie) {
Lines 392-397 sub checkauth { Link Here
392
        -HttpOnly => 1,
395
        -HttpOnly => 1,
393
        -expires => '',
396
        -expires => '',
394
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
397
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
398
        -sameSite => 'Lax'
395
    );
399
    );
396
    print $query->header(
400
    print $query->header(
397
        -type    => 'text/html; charset=utf-8',
401
        -type    => 'text/html; charset=utf-8',
(-)a/C4/Templates.pm (-1 / +2 lines)
Lines 342-348 sub getlanguagecookie { Link Here
342
        -name    => 'KohaOpacLanguage',
342
        -name    => 'KohaOpacLanguage',
343
        -value   => $language,
343
        -value   => $language,
344
        -HttpOnly => 1,
344
        -HttpOnly => 1,
345
        -expires => '+3y'
345
        -expires => '+3y',
346
        -sameSite => 'Lax'
346
    );
347
    );
347
348
348
    return $cookie;
349
    return $cookie;
(-)a/cataloguing/additem.pl (-1 / +2 lines)
Lines 220-226 if ($op eq "additem") { Link Here
220
                    # We encode_base64url the whole freezed structure so we're sure we won't have any encoding problems
220
                    # We encode_base64url the whole freezed structure so we're sure we won't have any encoding problems
221
                    -value   => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ),
221
                    -value   => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ),
222
                    -HttpOnly => 1,
222
                    -HttpOnly => 1,
223
                    -expires => ''
223
                    -expires => '',
224
                    -sameSite => 'Lax'
224
                );
225
                );
225
226
226
                $cookie = [ $cookie, $last_created_item_cookie ];
227
                $cookie = [ $cookie, $last_created_item_cookie ];
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc (-1 / +1 lines)
Lines 12-18 function mergeAuth(authid, summary) { Link Here
12
        }
12
        }
13
        window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring;
13
        window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring;
14
    } else {
14
    } else {
15
        Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/' });
15
        Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: 'Lax' });
16
        showMergingInProgress();
16
        showMergingInProgress();
17
    }
17
    }
18
}
18
}
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc (-1 / +1 lines)
Lines 1207-1213 require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr Link Here
1207
        $( '#switch-editor' ).click( function() {
1207
        $( '#switch-editor' ).click( function() {
1208
            if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return;
1208
            if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return;
1209
1209
1210
            Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/' } );
1210
            Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: 'Lax'} );
1211
1211
1212
            if ( state.backend == 'catalog' ) {
1212
            if ( state.backend == 'catalog' ) {
1213
                window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID;
1213
                window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID;
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt (-1 / +1 lines)
Lines 329-335 MARC frameworks › Administration › Koha Link Here
329
            }));
329
            }));
330
            $("#select_display").on("change",function(){
330
            $("#select_display").on("change",function(){
331
                var checked = $(this).prop("checked") ? 1: 0;
331
                var checked = $(this).prop("checked") ? 1: 0;
332
                Cookies.set("marctagstructure_selectdisplay", checked);
332
                Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: 'Lax' });
333
                this.form.submit();
333
                this.form.submit();
334
            });
334
            });
335
        });
335
        });
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt (-5 / +5 lines)
Lines 130-136 Link Here
130
130
131
            if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false;
131
            if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false;
132
132
133
            Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/' } );
133
            Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: 'Lax'  } );
134
134
135
            var biblionumber = [% biblionumber || "null" | html %];
135
            var biblionumber = [% biblionumber || "null" | html %];
136
136
Lines 508-518 function PopupMARCFieldDoc(field) { Link Here
508
    function toggleMARCdocLinks(flag){
508
    function toggleMARCdocLinks(flag){
509
        if( flag === true ){
509
        if( flag === true ){
510
            $(".marcdocs").show();
510
            $(".marcdocs").show();
511
            Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365 });
511
            Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax'  });
512
            $("#marcDocsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
512
            $("#marcDocsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
513
        } else {
513
        } else {
514
            $(".marcdocs").hide();
514
            $(".marcdocs").hide();
515
            Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365 });
515
            Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax'  });
516
            $("#marcDocsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
516
            $("#marcDocsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
517
        }
517
        }
518
    }
518
    }
Lines 521-532 function PopupMARCFieldDoc(field) { Link Here
521
        if( flag === true ){
521
        if( flag === true ){
522
            $(".tagnum").show();
522
            $(".tagnum").show();
523
            $(".subfieldcode").show();
523
            $(".subfieldcode").show();
524
            Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365 });
524
            Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax'  });
525
            $("#marcTagsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
525
            $("#marcTagsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
526
        } else {
526
        } else {
527
            $(".tagnum").hide();
527
            $(".tagnum").hide();
528
            $(".subfieldcode").hide();
528
            $(".subfieldcode").hide();
529
            Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365 });
529
            Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax'  });
530
            $("#marcTagsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
530
            $("#marcTagsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
531
        }
531
        }
532
    }
532
    }
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt (-1 / +1 lines)
Lines 295-301 Link Here
295
            });
295
            });
296
296
297
            $("#useadvanced").click(function(){
297
            $("#useadvanced").click(function(){
298
                Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/' } );
298
                Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } );
299
                return true;
299
                return true;
300
            });
300
            });
301
301
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt (-1 / +1 lines)
Lines 235-241 Link Here
235
        function SearchToHold(club_id) {
235
        function SearchToHold(club_id) {
236
            var date = new Date();
236
            var date = new Date();
237
            date.setTime(date.getTime() + (10 * 60 * 1000));
237
            date.setTime(date.getTime() + (10 * 60 * 1000));
238
            Cookies.set("holdforclub", club_id, { path: "/", expires: date });
238
            Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: 'Lax'  });
239
            location.href="/cgi-bin/koha/catalogue/search.pl";
239
            location.href="/cgi-bin/koha/catalogue/search.pl";
240
        }
240
        }
241
    </script>
241
    </script>
(-)a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js (-1 / +1 lines)
Lines 3-9 function searchToOrder( basketno, vendorid ){ Link Here
3
    var cookieData = "";
3
    var cookieData = "";
4
    date.setTime(date.getTime() + (10 * 60 * 1000));
4
    date.setTime(date.getTime() + (10 * 60 * 1000));
5
    cookieData += basketno + "/" + vendorid;
5
    cookieData += basketno + "/" + vendorid;
6
    Cookies.set("searchToOrder", cookieData, { path: "/", expires: date });
6
    Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: 'Lax'  });
7
}
7
}
8
8
9
$(document).ready(function() {
9
$(document).ready(function() {
(-)a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js (-1 / +1 lines)
Lines 258-264 $(document).ready(function() { Link Here
258
        $('#issues-table-load-immediately').prop('checked', true);
258
        $('#issues-table-load-immediately').prop('checked', true);
259
    }
259
    }
260
    $('#issues-table-load-immediately').on( "change", function(){
260
    $('#issues-table-load-immediately').on( "change", function(){
261
        Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365 });
261
        Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: 'Lax'  });
262
    });
262
    });
263
263
264
    function RefreshIssuesTable() {
264
    function RefreshIssuesTable() {
(-)a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js (-1 / +1 lines)
Lines 160-165 function printx_window(print_type) { Link Here
160
function searchToHold(){
160
function searchToHold(){
161
    var date = new Date();
161
    var date = new Date();
162
    date.setTime(date.getTime() + (10 * 60 * 1000));
162
    date.setTime(date.getTime() + (10 * 60 * 1000));
163
    Cookies.set("holdfor", borrowernumber, { path: "/", expires: date });
163
    Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: 'Lax'  });
164
    location.href="/cgi-bin/koha/catalogue/search.pl";
164
    location.href="/cgi-bin/koha/catalogue/search.pl";
165
}
165
}
(-)a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js (-4 / +4 lines)
Lines 52-61 function hideColumn(num) { Link Here
52
        if (!found) {
52
        if (!found) {
53
            valCookie.push(hide);
53
            valCookie.push(hide);
54
            var cookieString = valCookie.join("/");
54
            var cookieString = valCookie.join("/");
55
            Cookies.set("showColumns", cookieString, { expires: date, path: '/' });
55
            Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax'  });
56
        }
56
        }
57
    } else {
57
    } else {
58
        Cookies.set("showColumns", hide, { expires: date, path: '/' });
58
        Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: 'Lax'  });
59
    }
59
    }
60
}
60
}
61
61
Lines 88-94 function showColumn(num) { Link Here
88
        }
88
        }
89
        if (found) {
89
        if (found) {
90
            var cookieString = valCookie.join("/");
90
            var cookieString = valCookie.join("/");
91
            Cookies.set("showColumns", cookieString, { expires: date, path: '/' });
91
            Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax'  });
92
        }
92
        }
93
    }
93
    }
94
}
94
}
Lines 113-119 function hideAllColumns() { Link Here
113
    $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide();
113
    $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide();
114
    $("#hideall").prop("checked", true).parent().addClass("selected");
114
    $("#hideall").prop("checked", true).parent().addClass("selected");
115
    var cookieString = allColumns.join("/");
115
    var cookieString = allColumns.join("/");
116
    Cookies.set("showColumns", cookieString, { expires: date, path: '/' });
116
    Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax'  });
117
}
117
}
118
118
119
$(document).ready(function () {
119
$(document).ready(function () {
(-)a/opac/sco/sco-main.pl (-1 / +1 lines)
Lines 374-379 $cookie = $query->cookie( Link Here
374
    -expires => $jwt ? '+1d' : '',
374
    -expires => $jwt ? '+1d' : '',
375
    -HttpOnly => 1,
375
    -HttpOnly => 1,
376
    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
376
    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
377
    -sameSite => 'Lax'
377
);
378
);
378
379
379
$template->param(patronid => $patronid);
380
$template->param(patronid => $patronid);
380
- 

Return to bug 26019