From 9375f6f6e7c8f6fe57bd6f2810a0b90e028d78d6 Mon Sep 17 00:00:00 2001 From: Alex Buckley Date: Thu, 23 Mar 2023 09:59:20 +1300 Subject: [PATCH] Bug 33259: Optionally set SameSite attribute of session cookie to Strict Note: The below test plan is assuming you are running the Mozilla Firefox browser. Test plan: 1. Apply patches 2. Upgrade database sudo koha-upgrade-schema 3. Confirm the new system preference 'SameSiteSessionCookie' is 'Lax' 4. Go to a staff client and OPAC page, right click, choose 'Inspect', go to the 'Storage' tab, click on 'Cookies', click on 'CGISESSID' 5. Confirm 'SameSite' = 'Lax' 6. Change the 'SameSiteSessionCookie' to 'Strict' 7. Open a new private browser window. Go to a staff client and OPAC page, right click, choose 'Inspect, go to the 'Storage' tab, click on 'Cookies', click on 'CGISESSID' 8. Repeat step 4 and confirm 'SameSite' = 'Strict' 9. Go to: Cataloguing > New record 10. Right click, click 'Inspect', go to the 'Console' tab, confirm there are no JavaScript errors Sponsored-by: Toi Ohomai Institute of Technology, New Zealand --- C4/Auth.pm | 18 +++++++++--------- C4/InstallAuth.pm | 8 ++++---- C4/Templates.pm | 2 +- cataloguing/additem.pl | 4 ++-- installer/data/mysql/mandatory/sysprefs.sql | 1 - .../prog/en/includes/authorities_js.inc | 2 +- .../prog/en/includes/cateditor-ui.inc | 2 +- .../prog/en/modules/admin/marctagstructure.tt | 2 +- .../prog/en/modules/cataloguing/addbiblio.tt | 10 +++++----- .../prog/en/modules/cataloguing/addbooks.tt | 2 +- .../en/modules/cataloguing/cataloging-home.tt | 2 +- .../prog/en/modules/clubs/clubs.tt | 2 +- .../intranet-tmpl/prog/js/acquisitions-menu.js | 2 +- koha-tmpl/intranet-tmpl/prog/js/checkouts.js | 2 +- .../intranet-tmpl/prog/js/members-menu.js | 2 +- .../intranet-tmpl/prog/js/pages/batchMod.js | 8 ++++---- .../bootstrap/en/modules/opac-advsearch.tt | 8 ++++---- opac/sco/sco-main.pl | 2 +- 18 files changed, 39 insertions(+), 40 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index adc1b5dd0d0..340056e9cd1 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -256,7 +256,7 @@ sub get_template_and_user { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), )); my $auth_error = $in->{query}->param('auth_error'); @@ -841,7 +841,7 @@ sub checkauth { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), )); $loggedin = 1; } @@ -914,7 +914,7 @@ sub checkauth { -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), )); $flags = haspermission( $userid, $flagsrequired ); @@ -986,7 +986,7 @@ sub checkauth { -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), )); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { @@ -1194,7 +1194,7 @@ sub checkauth { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), )); $info{'wrongip'} = 1; } @@ -1303,7 +1303,7 @@ sub checkauth { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), )); } @@ -1469,7 +1469,7 @@ sub checkauth { charset => 'utf-8', cookie => $cookie, 'X-Frame-Options' => 'SAMEORIGIN', - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) } ), $template->output; @@ -1553,7 +1553,7 @@ sub check_api_auth { -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); return ( $return, $cookie, $session ); # return == 'ok' here @@ -1594,7 +1594,7 @@ sub check_api_auth { -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); if ( $return == 1 ) { my ( diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 56dd8e32602..ec55cea378b 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -262,7 +262,7 @@ sub checkauth { -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); $loggedin = 1; $userid = $session->param('cardnumber'); @@ -303,7 +303,7 @@ sub checkauth { -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); if ( $return == 2 ) { @@ -351,7 +351,7 @@ sub checkauth { -HttpOnly => 1, -expires => '', -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); } if ($envcookie) { @@ -395,7 +395,7 @@ sub checkauth { -HttpOnly => 1, -expires => '', -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); print $query->header( -type => 'text/html; charset=utf-8', diff --git a/C4/Templates.pm b/C4/Templates.pm index dd54a6e3f41..e8471bd7e95 100644 --- a/C4/Templates.pm +++ b/C4/Templates.pm @@ -347,7 +347,7 @@ sub getlanguagecookie { -value => $language, -HttpOnly => 1, -expires => '+3y', - -sameSite => 'Lax', + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ), -secure => ( C4::Context->https_enabled() ? 1 : 0 ), ); diff --git a/cataloguing/additem.pl b/cataloguing/additem.pl index bbf801bdac0..5e2dcdd4afd 100755 --- a/cataloguing/additem.pl +++ b/cataloguing/additem.pl @@ -213,7 +213,7 @@ if ($load_template_submit || $unload_template_submit) { -value => $cookie_value, -HttpOnly => 1, -expires => '', - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); $cookie = [ $cookie, $template_cookie ]; @@ -336,7 +336,7 @@ if ($op eq "additem") { -value => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ), -HttpOnly => 1, -expires => '', - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); $cookie = [ $cookie, $last_created_item_cookie ]; diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql index 26061235eb4..2f623bdf220 100644 --- a/installer/data/mysql/mandatory/sysprefs.sql +++ b/installer/data/mysql/mandatory/sysprefs.sql @@ -668,7 +668,6 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('ShowAllCheckins', '0', '', 'Show all checkins', 'YesNo'), ('ShowComponentRecords', 'nowhere', 'nowhere|staff|opac|both','In which record detail pages to show list of the component records, as linked via 773','Choice'), ('MaxComponentRecords', '300', '','Max number of component records to display','Integer'), -('SameSiteSessionCookie', '0', NULL, 'If Strict, then the SameSite attribute of the session cookie will be set to Strict, rather than the default Lax', 'YesNo'), ('ShowHeadingUse', '0', NULL, 'Show whether authority record contains an established heading that conforms to descriptive cataloguing rules, and can therefore be used as a main/added entry, or subject, or series title', 'YesNo'), ('showLastPatron','0','','If ON, enables the last patron feature in the intranet','YesNo'), ('ShowPatronImageInWebBasedSelfCheck','0','','If ON, displays patron image when a patron uses web-based self-checkout','YesNo'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc index 67d0eb6395d..642961642c0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc @@ -12,7 +12,7 @@ function mergeAuth(authid, summary) { } window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring; } else { - Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: 'Lax' }); + Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); showMergingInProgress(); } } diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc index a167314729f..49f85dfaaef 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc @@ -1225,7 +1225,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr $( '#switch-editor' ).click( function() { if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return; - Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: 'Lax'} ); + Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' } ); if ( state.backend == 'catalog' ) { window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt index 35695a81e2f..def11f85e8c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt @@ -338,7 +338,7 @@ MARC frameworks › Administration › Koha })); $("#select_display").on("change",function(){ var checked = $(this).prop("checked") ? 1: 0; - Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: 'Lax' }); + Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); this.form.submit(); }); }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt index 0207a5e9e19..6175e0a1114 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt @@ -140,7 +140,7 @@ if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false; - Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: 'Lax' } ); + Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' } ); var biblionumber = [% biblionumber || "null" | html %]; @@ -518,11 +518,11 @@ function PopupMARCFieldDoc(field) { function toggleMARCdocLinks(flag){ if( flag === true ){ $(".marcdocs").show(); - Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); $("#marcDocsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o'); } else { $(".marcdocs").hide(); - Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); $("#marcDocsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o'); } } @@ -531,12 +531,12 @@ function PopupMARCFieldDoc(field) { if( flag === true ){ $(".tagnum").show(); $(".subfieldcode").show(); - Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); $("#marcTagsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o'); } else { $(".tagnum").hide(); $(".subfieldcode").hide(); - Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); $("#marcTagsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o'); } } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt index ce30a2fc1c3..ccdbbc9b467 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt @@ -303,7 +303,7 @@ }); $("#useadvanced").click(function(){ - Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } ); + Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) %]' } ); return true; }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt index 0418628b332..58d3f981fd3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt @@ -230,7 +230,7 @@ }); $("#useadvanced").click(function(){ - Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } ); + Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' } ); return true; }); }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt index ffdbf47e126..1b9879ab294 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt @@ -242,7 +242,7 @@ function SearchToHold(club_id) { var date = new Date(); date.setTime(date.getTime() + (10 * 60 * 1000)); - Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: 'Lax' }); + Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); location.href="/cgi-bin/koha/catalogue/search.pl"; } diff --git a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js b/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js index 313ae0f5ef9..d8aae3afc7f 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js +++ b/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js @@ -3,7 +3,7 @@ function searchToOrder( basketno, vendorid ){ var cookieData = ""; date.setTime(date.getTime() + (10 * 60 * 1000)); cookieData += basketno + "/" + vendorid; - Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: 'Lax' }); + Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); } $(document).ready(function() { diff --git a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js b/koha-tmpl/intranet-tmpl/prog/js/checkouts.js index 534fec1cdaa..bd4b0be4ed6 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js +++ b/koha-tmpl/intranet-tmpl/prog/js/checkouts.js @@ -256,7 +256,7 @@ $(document).ready(function() { $('#issues-table-load-immediately').prop('checked', true); } $('#issues-table-load-immediately').on( "change", function(){ - Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: 'Lax' }); + Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); }); function RefreshIssuesTable() { diff --git a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js index b020966e588..7d94874f4a6 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js +++ b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js @@ -160,6 +160,6 @@ function printx_window(print_type) { function searchToHold(){ var date = new Date(); date.setTime(date.getTime() + (10 * 60 * 1000)); - Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: 'Lax' }); + Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); location.href="/cgi-bin/koha/catalogue/search.pl"; } diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js b/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js index 56d5270a538..d9a3dc01a3b 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js +++ b/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js @@ -52,10 +52,10 @@ function hideColumn(num) { if (!found) { valCookie.push(hide); var cookieString = valCookie.join("/"); - Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); } } else { - Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); } } @@ -88,7 +88,7 @@ function showColumn(num) { } if (found) { var cookieString = valCookie.join("/"); - Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); } } } @@ -113,7 +113,7 @@ function hideAllColumns() { $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide(); $("#hideall").prop("checked", true).parent().addClass("selected"); var cookieString = allColumns.join("/"); - Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); } $(document).ready(function () { diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt index 3f0e874bfed..ef57d1dab4c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt @@ -523,18 +523,18 @@ $(document).ready(function() { } }); form_serialized = $(this).serialize(); - Cookies.set("form_serialized", JSON.stringify( form_serialized ), { path: '/', sameSite: 'Lax' }); + Cookies.set("form_serialized", JSON.stringify( form_serialized ), { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); form_serialized_limits = [ $('#language-limit').val(), $('#branchloop').val(), $('#subtype_audience').val(), $('#subtype_content').val(), $('#subtype_format').val(), $('#subtype_additional').val(), $('#locloop').val() ]; - Cookies.set("form_serialized_limits", JSON.stringify( form_serialized_limits ),{ path: '/', sameSite: 'Lax' }); + Cookies.set("form_serialized_limits", JSON.stringify( form_serialized_limits ),{ path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); [% IF ( expanded_options ) %] - Cookies.set("search_path_code", 'exs', { path: '/', sameSite: 'Lax' }); + Cookies.set("search_path_code", 'exs', { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); [% ELSE %] - Cookies.set("search_path_code", 'ads', { path: '/', sameSite: 'Lax' }); + Cookies.set("search_path_code", 'ads', { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' %]' }); [% END %] }); diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index ac89db749cc..21b14a2fe70 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -375,7 +375,7 @@ $cookie = $query->cookie( -expires => $jwt ? '+1d' : '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => ( C4::Context->preference('SameSiteSessionCookie') ? 'Strict' : 'Lax' ) ); $template->param(patronid => $patronid); -- 2.20.1