View | Details | Raw Unified | Return to bug 31250
Collapse All | Expand All

(-)a/Koha/CookieManager.pm (-5 / +16 lines)
Lines 101-111 sub clear_unless { Link Here
101
        }
101
        }
102
        next if !$name;
102
        next if !$name;
103
103
104
        # Try stripping _\d+ from name for cookiea like catalogue_editor_123
104
        if( $self->_should_be_cleared($name) ) {
105
        my $stripped_name = $name;
106
        $stripped_name =~ s/_\d+$/_/;
107
108
        if( !$self->{_remove_unless}->{$stripped_name} && !$self->{_remove_unless}->{$name} ) {
109
            next if $seen->{$name};
105
            next if $seen->{$name};
110
            push @rv, CGI::Cookie->new(
106
            push @rv, CGI::Cookie->new(
111
                # -expires explicitly omitted to create shortlived 'session' cookie
107
                # -expires explicitly omitted to create shortlived 'session' cookie
Lines 122-127 sub clear_unless { Link Here
122
    return \@rv;
118
    return \@rv;
123
}
119
}
124
120
121
sub _should_be_cleared { # when it is not on the deny list in koha-conf
122
    my ( $self, $name ) = @_;
123
124
    return if $self->{_remove_unless}->{$name}; # exact match
125
126
    # Now try the entries as regex
127
    foreach my $k ( keys %{$self->{_remove_unless}} ) {
128
        my $reg = $self->{_remove_unless}->{$k};
129
        # The entry in koha-conf should match the complete string
130
        # So adding a ^ and $
131
        return if $name =~ qr/^${k}$/;
132
    }
133
    return 1;
134
}
135
125
=head2 replace_in_list
136
=head2 replace_in_list
126
137
127
    $list2 = $mgr->replace_in_list( $list1, $cookie );
138
    $list2 = $mgr->replace_in_list( $list1, $cookie );
(-)a/debian/templates/koha-conf-site.xml.in (-1 / +2 lines)
Lines 457-465 __END_SRU_PUBLICSERVER__ Link Here
457
 </message_broker>
457
 </message_broker>
458
458
459
 <do_not_remove_cookie>__KEEP_COOKIE__</do_not_remove_cookie>
459
 <do_not_remove_cookie>__KEEP_COOKIE__</do_not_remove_cookie>
460
 <do_not_remove_cookie>catalogue_editor_</do_not_remove_cookie>
460
 <do_not_remove_cookie>catalogue_editor_\d+</do_not_remove_cookie>
461
 <!-- Uncomment lines like hereunder to not clear cookies at logout:
461
 <!-- Uncomment lines like hereunder to not clear cookies at logout:
462
      The cookie name is case sensitive.
462
      The cookie name is case sensitive.
463
      NOTE: You may use regex constructions like the example above.
463
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
464
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
464
 -->
465
 -->
465
466
(-)a/etc/koha-conf.xml (-1 / +2 lines)
Lines 273-281 Link Here
273
   <vhost></vhost>
273
   <vhost></vhost>
274
 </message_broker>
274
 </message_broker>
275
275
276
 <do_not_remove_cookie>catalogue_editor_</do_not_remove_cookie>
276
 <do_not_remove_cookie>catalogue_editor_\d+</do_not_remove_cookie>
277
 <!-- Uncomment lines like hereunder to not clear cookies at logout:
277
 <!-- Uncomment lines like hereunder to not clear cookies at logout:
278
      The cookie name is case sensitive.
278
      The cookie name is case sensitive.
279
      NOTE: You may use regex constructions like the example above.
279
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
280
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
280
 -->
281
 -->
281
282
(-)a/t/CookieManager.t (-8 / +20 lines)
Lines 41-47 subtest 'new' => sub { Link Here
41
};
41
};
42
42
43
subtest 'clear_unless' => sub {
43
subtest 'clear_unless' => sub {
44
    plan tests => 16;
44
    plan tests => 17;
45
45
46
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'aap', 'noot' ] );
46
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'aap', 'noot' ] );
47
47
Lines 74-92 subtest 'clear_unless' => sub { Link Here
74
    is( $rv[1]->httponly, 0, 'cleared wim is not httponly' );
74
    is( $rv[1]->httponly, 0, 'cleared wim is not httponly' );
75
    is( $rv[2]->httponly, 1, 'aap httponly' );
75
    is( $rv[2]->httponly, 1, 'aap httponly' );
76
76
77
    # Test with _123 prefix
77
    # Test with numeric suffix (via regex)
78
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'catalogue_editor_' ] );
78
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'catalogue_editor_\d+' ] );
79
    $cmgr = Koha::CookieManager->new;
79
    $cmgr = Koha::CookieManager->new;
80
    $cookie1 = $q->cookie( -name => 'catalogue_editor_234', -value => '1', -expires => '+1y' );
80
    $cookie1 = $q->cookie( -name => 'catalogue_editor_abc', -value => '1', -expires => '+1y' );
81
    $cookie2 = $q->cookie( -name => 'catalogue_editor_345', -value => '1', -expires => '+1y' );
81
    $cookie2 = $q->cookie( -name => 'catalogue_editor_345', -value => '1', -expires => '+1y' );
82
    $cookie3 = $q->cookie( -name => 'catalogue_editor_', -value => '1', -expires => '+1y' );
82
    $cookie3 = $q->cookie( -name => 'catalogue_editor_', -value => '1', -expires => '+1y' );
83
    $cookie4 = $q->cookie( -name => 'catalogue_editor', -value => '1', -expires => '+1y' );
83
    $cookie4 = $q->cookie( -name => 'catalogue_editor_123x', -value => '1', -expires => '+1y' );
84
84
85
    $list = [ $cookie1, $cookie2, $cookie3, $cookie4 ];
85
    $list = [ $cookie1, $cookie2, $cookie3, $cookie4 ];
86
    @rv = @{$cmgr->clear_unless( @$list )};
86
    @rv = @{$cmgr->clear_unless( @$list )};
87
    is_deeply( [ map { $_->value ? $_->name : () } @rv ],
87
    is_deeply( [ map { $_->value ? $_->name : () } @rv ],
88
        [ 'catalogue_editor_234', 'catalogue_editor_345', 'catalogue_editor_' ],
88
        [ 'catalogue_editor_345' ],
89
        'Only cookie4 should have been cleared' );
89
        'Cookie2 should be found only' );
90
91
    # Test with another regex (yes, highly realistic examples :)
92
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'next_\w+_number\d{2}_(now|never)' ] );
93
    $cmgr = Koha::CookieManager->new;
94
    my $cookie5;
95
    $cookie1 = $q->cookie( -name => 'next_mynewword_number99_never', -value => '1', -expires => '+1y' ); #fine
96
    $cookie2 = $q->cookie( -name => 'prefixed_next_mynewword_number99_never', -value => '1', -expires => '+1y' ); # wrong prefix
97
    $cookie3 = $q->cookie( -name => 'next_mynew-word_number99_never', -value => '1', -expires => '+1y' ); # wrong: hyphen in word
98
    $cookie4 = $q->cookie( -name => 'mynewword_number999_never', -value => '1', -expires => '+1y' ); # wrong: three digits
99
    $cookie5 = $q->cookie( -name => 'next_mynewword_number99_always', -value => '1', -expires => '+1y' ); # wrong: always
100
    @rv = @{$cmgr->clear_unless( $cookie1, $cookie2, $cookie3, $cookie4, $cookie5 )};
101
    is_deeply( [ map { $_->value ? $_->name : () } @rv ], [ 'next_mynewword_number99_never' ], 'Only cookie1 matched' );
102
90
};
103
};
91
104
92
subtest 'replace_in_list' => sub {
105
subtest 'replace_in_list' => sub {
93
- 

Return to bug 31250