View | Details | Raw Unified | Return to bug 26019
Collapse All | Expand All

(-)a/C4/Auth.pm (-1 / +10 lines)
Lines 249-254 sub get_template_and_user { Link Here
249
                -expires  => '',
249
                -expires  => '',
250
                -HttpOnly => 1,
250
                -HttpOnly => 1,
251
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
251
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
252
                -sameSite => 'Lax'
252
            );
253
            );
253
254
254
            $template->param(
255
            $template->param(
Lines 875-880 sub checkauth { Link Here
875
            -expires  => '',
876
            -expires  => '',
876
            -HttpOnly => 1,
877
            -HttpOnly => 1,
877
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
878
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
879
            -sameSite => 'Lax'
878
        );
880
        );
879
        $loggedin = 1;
881
        $loggedin = 1;
880
    }
882
    }
Lines 932-937 sub checkauth { Link Here
932
                    -value    => $session->id,
934
                    -value    => $session->id,
933
                    -HttpOnly => 1,
935
                    -HttpOnly => 1,
934
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
936
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
937
                    -sameSite => 'Lax'
935
                );
938
                );
936
939
937
                $flags = haspermission( $userid, $flagsrequired );
940
                $flags = haspermission( $userid, $flagsrequired );
Lines 976-981 sub checkauth { Link Here
976
            -value    => $sessionID,
979
            -value    => $sessionID,
977
            -HttpOnly => 1,
980
            -HttpOnly => 1,
978
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
981
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
982
            -sameSite => 'Lax'
979
        );
983
        );
980
        my $pki_field = C4::Context->preference('AllowPKIAuth');
984
        my $pki_field = C4::Context->preference('AllowPKIAuth');
981
        if ( !defined($pki_field) ) {
985
        if ( !defined($pki_field) ) {
Lines 1176-1181 sub checkauth { Link Here
1176
                                -value    => '',
1180
                                -value    => '',
1177
                                -HttpOnly => 1,
1181
                                -HttpOnly => 1,
1178
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1182
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1183
                                -sameSite => 'Lax'
1179
                            );
1184
                            );
1180
                            $info{'wrongip'} = 1;
1185
                            $info{'wrongip'} = 1;
1181
                        }
1186
                        }
Lines 1265-1270 sub checkauth { Link Here
1265
                -value    => '',
1270
                -value    => '',
1266
                -HttpOnly => 1,
1271
                -HttpOnly => 1,
1267
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1272
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1273
                -sameSite => 'Lax'
1268
            );
1274
            );
1269
        }
1275
        }
1270
1276
Lines 1417-1423 sub checkauth { Link Here
1417
        {   type              => 'text/html',
1423
        {   type              => 'text/html',
1418
            charset           => 'utf-8',
1424
            charset           => 'utf-8',
1419
            cookie            => $cookie,
1425
            cookie            => $cookie,
1420
            'X-Frame-Options' => 'SAMEORIGIN'
1426
            'X-Frame-Options' => 'SAMEORIGIN',
1427
            -sameSite => 'Lax'
1421
        }
1428
        }
1422
      ),
1429
      ),
1423
      $template->output;
1430
      $template->output;
Lines 1500-1505 sub check_api_auth { Link Here
1500
            -value    => $session->id,
1507
            -value    => $session->id,
1501
            -HttpOnly => 1,
1508
            -HttpOnly => 1,
1502
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1509
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1510
            -sameSite => 'Lax'
1503
        );
1511
        );
1504
        return ( $return, undef, $session );
1512
        return ( $return, undef, $session );
1505
1513
Lines 1540-1545 sub check_api_auth { Link Here
1540
                -value    => $sessionID,
1548
                -value    => $sessionID,
1541
                -HttpOnly => 1,
1549
                -HttpOnly => 1,
1542
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1550
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1551
                -sameSite => 'Lax'
1543
            );
1552
            );
1544
            if ( $return == 1 ) {
1553
            if ( $return == 1 ) {
1545
                my (
1554
                my (
(-)a/C4/InstallAuth.pm (+4 lines)
Lines 262-267 sub checkauth { Link Here
262
                -value    => $session->id,
262
                -value    => $session->id,
263
                -HttpOnly => 1,
263
                -HttpOnly => 1,
264
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
264
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
265
                -sameSite => 'Lax'
265
            );
266
            );
266
            $loggedin = 1;
267
            $loggedin = 1;
267
            $userid   = $session->param('cardnumber');
268
            $userid   = $session->param('cardnumber');
Lines 302-307 sub checkauth { Link Here
302
                -value    => $sessionID,
303
                -value    => $sessionID,
303
                -HttpOnly => 1,
304
                -HttpOnly => 1,
304
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
305
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
306
                -sameSite => 'Lax'
305
            );
307
            );
306
            if ( $return == 2 ) {
308
            if ( $return == 2 ) {
307
309
Lines 349-354 sub checkauth { Link Here
349
                -HttpOnly => 1,
351
                -HttpOnly => 1,
350
                -expires => '',
352
                -expires => '',
351
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
353
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
354
                -sameSite => 'Lax'
352
            );
355
            );
353
        }
356
        }
354
        if ($envcookie) {
357
        if ($envcookie) {
Lines 392-397 sub checkauth { Link Here
392
        -HttpOnly => 1,
395
        -HttpOnly => 1,
393
        -expires => '',
396
        -expires => '',
394
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
397
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
398
        -sameSite => 'Lax'
395
    );
399
    );
396
    print $query->header(
400
    print $query->header(
397
        -type    => 'text/html; charset=utf-8',
401
        -type    => 'text/html; charset=utf-8',
(-)a/C4/Templates.pm (+1 lines)
Lines 349-354 sub getlanguagecookie { Link Here
349
        -value   => $language,
349
        -value   => $language,
350
        -HttpOnly => 1,
350
        -HttpOnly => 1,
351
        -expires => '+3y',
351
        -expires => '+3y',
352
        -sameSite => 'Lax'
352
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
353
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
353
    );
354
    );
354
355
(-)a/cataloguing/additem.pl (-1 / +2 lines)
Lines 220-226 if ($op eq "additem") { Link Here
220
                    # We encode_base64url the whole freezed structure so we're sure we won't have any encoding problems
220
                    # We encode_base64url the whole freezed structure so we're sure we won't have any encoding problems
221
                    -value   => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ),
221
                    -value   => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ),
222
                    -HttpOnly => 1,
222
                    -HttpOnly => 1,
223
                    -expires => ''
223
                    -expires => '',
224
                    -sameSite => 'Lax'
224
                );
225
                );
225
226
226
                $cookie = [ $cookie, $last_created_item_cookie ];
227
                $cookie = [ $cookie, $last_created_item_cookie ];
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc (-1 / +1 lines)
Lines 12-18 function mergeAuth(authid, summary) { Link Here
12
        }
12
        }
13
        window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring;
13
        window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring;
14
    } else {
14
    } else {
15
        Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/' });
15
        Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: 'Lax' });
16
        showMergingInProgress();
16
        showMergingInProgress();
17
    }
17
    }
18
}
18
}
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc (-1 / +1 lines)
Lines 1207-1213 require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr Link Here
1207
        $( '#switch-editor' ).click( function() {
1207
        $( '#switch-editor' ).click( function() {
1208
            if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return;
1208
            if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return;
1209
1209
1210
            Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/' } );
1210
            Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: 'Lax'} );
1211
1211
1212
            if ( state.backend == 'catalog' ) {
1212
            if ( state.backend == 'catalog' ) {
1213
                window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID;
1213
                window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID;
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt (-1 / +1 lines)
Lines 329-335 MARC frameworks › Administration › Koha Link Here
329
            }));
329
            }));
330
            $("#select_display").on("change",function(){
330
            $("#select_display").on("change",function(){
331
                var checked = $(this).prop("checked") ? 1: 0;
331
                var checked = $(this).prop("checked") ? 1: 0;
332
                Cookies.set("marctagstructure_selectdisplay", checked);
332
                Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: 'Lax' });
333
                this.form.submit();
333
                this.form.submit();
334
            });
334
            });
335
        });
335
        });
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt (-5 / +5 lines)
Lines 130-136 Link Here
130
130
131
            if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false;
131
            if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false;
132
132
133
            Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/' } );
133
            Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: 'Lax'  } );
134
134
135
            var biblionumber = [% biblionumber || "null" | html %];
135
            var biblionumber = [% biblionumber || "null" | html %];
136
136
Lines 508-518 function PopupMARCFieldDoc(field) { Link Here
508
    function toggleMARCdocLinks(flag){
508
    function toggleMARCdocLinks(flag){
509
        if( flag === true ){
509
        if( flag === true ){
510
            $(".marcdocs").show();
510
            $(".marcdocs").show();
511
            Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365 });
511
            Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax'  });
512
            $("#marcDocsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
512
            $("#marcDocsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
513
        } else {
513
        } else {
514
            $(".marcdocs").hide();
514
            $(".marcdocs").hide();
515
            Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365 });
515
            Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax'  });
516
            $("#marcDocsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
516
            $("#marcDocsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
517
        }
517
        }
518
    }
518
    }
Lines 521-532 function PopupMARCFieldDoc(field) { Link Here
521
        if( flag === true ){
521
        if( flag === true ){
522
            $(".tagnum").show();
522
            $(".tagnum").show();
523
            $(".subfieldcode").show();
523
            $(".subfieldcode").show();
524
            Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365 });
524
            Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax'  });
525
            $("#marcTagsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
525
            $("#marcTagsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
526
        } else {
526
        } else {
527
            $(".tagnum").hide();
527
            $(".tagnum").hide();
528
            $(".subfieldcode").hide();
528
            $(".subfieldcode").hide();
529
            Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365 });
529
            Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax'  });
530
            $("#marcTagsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
530
            $("#marcTagsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
531
        }
531
        }
532
    }
532
    }
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt (-1 / +1 lines)
Lines 295-301 Link Here
295
            });
295
            });
296
296
297
            $("#useadvanced").click(function(){
297
            $("#useadvanced").click(function(){
298
                Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/' } );
298
                Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } );
299
                return true;
299
                return true;
300
            });
300
            });
301
301
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt (-1 / +1 lines)
Lines 235-241 Link Here
235
        function SearchToHold(club_id) {
235
        function SearchToHold(club_id) {
236
            var date = new Date();
236
            var date = new Date();
237
            date.setTime(date.getTime() + (10 * 60 * 1000));
237
            date.setTime(date.getTime() + (10 * 60 * 1000));
238
            Cookies.set("holdforclub", club_id, { path: "/", expires: date });
238
            Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: 'Lax'  });
239
            location.href="/cgi-bin/koha/catalogue/search.pl";
239
            location.href="/cgi-bin/koha/catalogue/search.pl";
240
        }
240
        }
241
    </script>
241
    </script>
(-)a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js (-1 / +1 lines)
Lines 3-9 function searchToOrder( basketno, vendorid ){ Link Here
3
    var cookieData = "";
3
    var cookieData = "";
4
    date.setTime(date.getTime() + (10 * 60 * 1000));
4
    date.setTime(date.getTime() + (10 * 60 * 1000));
5
    cookieData += basketno + "/" + vendorid;
5
    cookieData += basketno + "/" + vendorid;
6
    Cookies.set("searchToOrder", cookieData, { path: "/", expires: date });
6
    Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: 'Lax'  });
7
}
7
}
8
8
9
$(document).ready(function() {
9
$(document).ready(function() {
(-)a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js (-1 / +1 lines)
Lines 258-264 $(document).ready(function() { Link Here
258
        $('#issues-table-load-immediately').prop('checked', true);
258
        $('#issues-table-load-immediately').prop('checked', true);
259
    }
259
    }
260
    $('#issues-table-load-immediately').on( "change", function(){
260
    $('#issues-table-load-immediately').on( "change", function(){
261
        Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365 });
261
        Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: 'Lax'  });
262
    });
262
    });
263
263
264
    function RefreshIssuesTable() {
264
    function RefreshIssuesTable() {
(-)a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js (-1 / +1 lines)
Lines 168-173 function printx_window(print_type) { Link Here
168
function searchToHold(){
168
function searchToHold(){
169
    var date = new Date();
169
    var date = new Date();
170
    date.setTime(date.getTime() + (10 * 60 * 1000));
170
    date.setTime(date.getTime() + (10 * 60 * 1000));
171
    Cookies.set("holdfor", borrowernumber, { path: "/", expires: date });
171
    Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: 'Lax'  });
172
    location.href="/cgi-bin/koha/catalogue/search.pl";
172
    location.href="/cgi-bin/koha/catalogue/search.pl";
173
}
173
}
(-)a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js (-4 / +4 lines)
Lines 52-61 function hideColumn(num) { Link Here
52
        if (!found) {
52
        if (!found) {
53
            valCookie.push(hide);
53
            valCookie.push(hide);
54
            var cookieString = valCookie.join("/");
54
            var cookieString = valCookie.join("/");
55
            Cookies.set("showColumns", cookieString, { expires: date, path: '/' });
55
            Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax'  });
56
        }
56
        }
57
    } else {
57
    } else {
58
        Cookies.set("showColumns", hide, { expires: date, path: '/' });
58
        Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: 'Lax'  });
59
    }
59
    }
60
}
60
}
61
61
Lines 88-94 function showColumn(num) { Link Here
88
        }
88
        }
89
        if (found) {
89
        if (found) {
90
            var cookieString = valCookie.join("/");
90
            var cookieString = valCookie.join("/");
91
            Cookies.set("showColumns", cookieString, { expires: date, path: '/' });
91
            Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax'  });
92
        }
92
        }
93
    }
93
    }
94
}
94
}
Lines 113-119 function hideAllColumns() { Link Here
113
    $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide();
113
    $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide();
114
    $("#hideall").prop("checked", true).parent().addClass("selected");
114
    $("#hideall").prop("checked", true).parent().addClass("selected");
115
    var cookieString = allColumns.join("/");
115
    var cookieString = allColumns.join("/");
116
    Cookies.set("showColumns", cookieString, { expires: date, path: '/' });
116
    Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax'  });
117
}
117
}
118
118
119
$(document).ready(function () {
119
$(document).ready(function () {
(-)a/opac/sco/sco-main.pl (-1 / +1 lines)
Lines 376-381 $cookie = $query->cookie( Link Here
376
    -expires => $jwt ? '+1d' : '',
376
    -expires => $jwt ? '+1d' : '',
377
    -HttpOnly => 1,
377
    -HttpOnly => 1,
378
    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
378
    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
379
    -sameSite => 'Lax'
379
);
380
);
380
381
381
$template->param(patronid => $patronid);
382
$template->param(patronid => $patronid);
382
- 

Return to bug 26019