From c2036347d8601a5b5d4f7e7f5f32a6961aad62bb Mon Sep 17 00:00:00 2001 From: Alex Buckley Date: Thu, 23 Mar 2023 09:57:11 +1300 Subject: [PATCH] Bug 33259: Add SameSiteSessionCookie system preference Sponsored-by: Toi Ohomai Institute of Technology, New Zealand Signed-off-by: Sally --- .../bug_33259-add_SameSiteSessionCookie_syspref.pl | 14 ++++++++++++++ installer/data/mysql/mandatory/sysprefs.sql | 1 + .../prog/en/modules/admin/preferences/admin.pref | 9 +++++++++ 3 files changed, 24 insertions(+) create mode 100755 installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl diff --git a/installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl b/installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl new file mode 100755 index 00000000000..9c5933aab63 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_33259-add_SameSiteSessionCookie_syspref.pl @@ -0,0 +1,14 @@ +use Modern::Perl; + +return { + bug_number => "33259", + description => "Bug 33259: Optionally set SameSite attribute of cookie to Strict", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + $dbh->do(q{INSERT IGNORE INTO systempreferences (variable,value,options,explanation,type) VALUES ('SameSiteSessionCookie', 'Lax', 'None|Lax|Strict', 'If Strict, then the SameSite attribute of the session cookie will be set to Strict, rather than the default Lax. None means you want the cookie sent iun a third-party context.', 'Choice') }); + + say $out "Added new system preference 'SameSiteSessionCookie'"; + }, +}; diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql index f8fd314f2cb..d096b6f7c55 100644 --- a/installer/data/mysql/mandatory/sysprefs.sql +++ b/installer/data/mysql/mandatory/sysprefs.sql @@ -637,6 +637,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('RoutingListAddReserves','0','','If ON the patrons on routing lists are automatically added to holds on the issue.','YesNo'), ('RoutingListNote','To change this note edit RoutingListNote system preference.','70|10','Define a note to be shown on all routing lists','Textarea'), ('RoutingSerials','1',NULL,'If ON, serials routing is enabled','YesNo'), +('SameSiteSessionCookie', 'Lax', 'None|Lax|Strict', 'If Strict, then the SameSite attribute of the session cookie will be set to Strict, rather than the default Lax. None means you want the cookie sent iun a third-party context.', 'Choice'), ('SavedSearchFilters', '0', NULL, 'Allow staff with permission to create/edit custom search filters', 'YesNo'), ('SCOAllowCheckin','0','','If enabled, patrons may return items through the Web-based Self Checkout','YesNo'), ('SCOMainUserBlock','','70|10','Add a block of HTML that will display on the self checkout screen','Textarea'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index c25ee189628..b2ce4de5431 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -480,3 +480,12 @@ Administration: "ARRAY": "Searchable array" -
ISO2709 format is recommended as it is faster and takes less space, whereas array format makes the full MARC record searchable. -
NOTE: Making the full record searchable may have a negative effect on relevance ranking of search results. + Session cookie: + - + - "Set the SameSite attribute of the session cookie to: " + - pref: SameSiteSessionCookie + default: Lax + choices: + None: None + Lax: Lax + Strict: Strict -- 2.20.1