From 87db50d7b3812a85304fbf9212e288eda32645c7 Mon Sep 17 00:00:00 2001 From: Alex Buckley Date: Thu, 23 Mar 2023 09:57:11 +1300 Subject: [PATCH] Bug 33259: Add SameSiteSessionCookie system preference Sponsored-by: Toi Ohomai Institute of Technology, New Zealand --- .../bug_33259-add_SameSiteSessionCookie_syspref.pl | 14 ++++++++++++++ installer/data/mysql/mandatory/sysprefs.sql | 2 ++ .../prog/en/modules/admin/preferences/admin.pref | 8 ++++++++ 3 files changed, 24 insertions(+) create mode 100755 installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl diff --git a/installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl b/installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl new file mode 100755 index 00000000000..1a7ab491fcf --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl @@ -0,0 +1,14 @@ +use Modern::Perl; + +return { + bug_number => "33259", + description => "Bug 33259: Optionally set SameSite attribute of cookie to Strict", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + $dbh->do(q{INSERT IGNORE INTO systempreferences (variable,value,options,explanation,type) VALUES ('SameSiteSessionCookie', '0', NULL, 'If Strict, then the SameSite attribute of the session cookie will be set to Strict, rather than the default Lax', 'YesNo') }); + + say $out "Added new system preference 'SameSiteSessionCookie'"; + }, +}; diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql index 98eced6bc0a..26061235eb4 100644 --- a/installer/data/mysql/mandatory/sysprefs.sql +++ b/installer/data/mysql/mandatory/sysprefs.sql @@ -636,6 +636,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('RoutingListAddReserves','0','','If ON the patrons on routing lists are automatically added to holds on the issue.','YesNo'), ('RoutingListNote','To change this note edit RoutingListNote system preference.','70|10','Define a note to be shown on all routing lists','Textarea'), ('RoutingSerials','1',NULL,'If ON, serials routing is enabled','YesNo'), +('SameSiteSessionCookie', '0', NULL, 'If Strict, then the SameSite attribute of the session cookie will be set to Strict, rather than the default Lax', 'YesNo'), ('SavedSearchFilters', '0', NULL, 'Allow staff with permission to create/edit custom search filters', 'YesNo'), ('SCOAllowCheckin','0','','If enabled, patrons may return items through the Web-based Self Checkout','YesNo'), ('SCOMainUserBlock','','70|10','Add a block of HTML that will display on the self checkout screen','Textarea'), @@ -667,6 +668,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('ShowAllCheckins', '0', '', 'Show all checkins', 'YesNo'), ('ShowComponentRecords', 'nowhere', 'nowhere|staff|opac|both','In which record detail pages to show list of the component records, as linked via 773','Choice'), ('MaxComponentRecords', '300', '','Max number of component records to display','Integer'), +('SameSiteSessionCookie', '0', NULL, 'If Strict, then the SameSite attribute of the session cookie will be set to Strict, rather than the default Lax', 'YesNo'), ('ShowHeadingUse', '0', NULL, 'Show whether authority record contains an established heading that conforms to descriptive cataloguing rules, and can therefore be used as a main/added entry, or subject, or series title', 'YesNo'), ('showLastPatron','0','','If ON, enables the last patron feature in the intranet','YesNo'), ('ShowPatronImageInWebBasedSelfCheck','0','','If ON, displays patron image when a patron uses web-based self-checkout','YesNo'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index c25ee189628..d2002961fc8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -480,3 +480,11 @@ Administration: "ARRAY": "Searchable array" -
ISO2709 format is recommended as it is faster and takes less space, whereas array format makes the full MARC record searchable. -
NOTE: Making the full record searchable may have a negative effect on relevance ranking of search results. + Session cookie: + - + - "Set the SameSite attribute of the session cookie to: " + - pref: SameSiteSessionCookie + default: 0 + choices: + 0: Lax + 1: Strict -- 2.20.1