From 6a1b60f9432f5c837e0e14b19b8498891f8580be Mon Sep 17 00:00:00 2001 From: Alex Buckley Date: Thu, 23 Mar 2023 09:59:20 +1300 Subject: [PATCH] Bug 33259: Optionally set SameSite attribute of session cookie to Strict Note: The below test plan is assuming you are running the Mozilla Firefox browser. Test plan: 1. Apply patches 2. Upgrade database sudo koha-upgrade-schema 3. Confirm the new system preference 'SameSiteSessionCookie' is 'Lax' 4. Go to a staff client and OPAC page, right click, choose 'Inspect', go to the 'Storage' tab, click on 'Cookies', click on 'CGISESSID' 5. Confirm 'SameSite' = 'Lax' 6. Change the 'SameSiteSessionCookie' to 'Strict' 7. Open a new private browser window. Go to a staff client and OPAC page, right click, choose 'Inspect, go to the 'Storage' tab, click on 'Cookies', click on 'CGISESSID' 8. Repeat step 4 and confirm 'SameSite' = 'Strict' 9. Go to: Cataloguing > New record 10. Right click, click 'Inspect', go to the 'Console' tab, confirm there are no JavaScript errors 11. Change 'SameSiteSessionCookie' to 'None' 12. Open a new private browser window, repeat step 4, and confirm the 'SameSite' = 'None' 13. Go to: Cataloguing > New record 14. Right click, click 'Inspect', go to the 'Console' tab, confirm there are no JavaScript errors. Sponsored-by: Toi Ohomai Institute of Technology, New Zealand Signed-off-by: Sally --- C4/Auth.pm | 18 +++++++++--------- C4/InstallAuth.pm | 8 ++++---- C4/Templates.pm | 2 +- cataloguing/additem.pl | 4 ++-- .../prog/en/includes/authorities_js.inc | 2 +- .../prog/en/includes/cateditor-ui.inc | 2 +- .../prog/en/modules/admin/marctagstructure.tt | 2 +- .../admin/preferences/.cataloguing.pref.swp | Bin 0 -> 16384 bytes .../prog/en/modules/cataloguing/addbiblio.tt | 11 ++++++----- .../prog/en/modules/cataloguing/addbooks.tt | 2 +- .../en/modules/cataloguing/cataloging-home.tt | 2 +- .../prog/en/modules/clubs/clubs.tt | 2 +- .../prog/js/acquisitions-menu.js | 2 +- koha-tmpl/intranet-tmpl/prog/js/checkouts.js | 2 +- .../intranet-tmpl/prog/js/members-menu.js | 2 +- .../intranet-tmpl/prog/js/pages/batchMod.js | 8 ++++---- .../bootstrap/en/modules/opac-advsearch.tt | 8 ++++---- opac/sco/sco-main.pl | 2 +- 18 files changed, 40 insertions(+), 39 deletions(-) create mode 100644 koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/.cataloguing.pref.swp diff --git a/C4/Auth.pm b/C4/Auth.pm index 6c308642f9c..c2260d9fd7f 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -256,7 +256,7 @@ sub get_template_and_user { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie'), )); my $auth_error = $in->{query}->param('auth_error'); @@ -842,7 +842,7 @@ sub checkauth { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie') )); $loggedin = 1; } @@ -915,7 +915,7 @@ sub checkauth { -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie'), )); $flags = haspermission( $userid, $flagsrequired ); @@ -987,7 +987,7 @@ sub checkauth { -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie'), )); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { @@ -1195,7 +1195,7 @@ sub checkauth { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie'), )); $info{'wrongip'} = 1; } @@ -1304,7 +1304,7 @@ sub checkauth { -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie'), )); } @@ -1470,7 +1470,7 @@ sub checkauth { charset => 'utf-8', cookie => $cookie, 'X-Frame-Options' => 'SAMEORIGIN', - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') } ), $template->output; @@ -1554,7 +1554,7 @@ sub check_api_auth { -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); return ( $return, $cookie, $session ); # return == 'ok' here @@ -1595,7 +1595,7 @@ sub check_api_auth { -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); if ( $return == 1 ) { my ( diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 56dd8e32602..d487c4e0e89 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -262,7 +262,7 @@ sub checkauth { -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); $loggedin = 1; $userid = $session->param('cardnumber'); @@ -303,7 +303,7 @@ sub checkauth { -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); if ( $return == 2 ) { @@ -351,7 +351,7 @@ sub checkauth { -HttpOnly => 1, -expires => '', -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); } if ($envcookie) { @@ -395,7 +395,7 @@ sub checkauth { -HttpOnly => 1, -expires => '', -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); print $query->header( -type => 'text/html; charset=utf-8', diff --git a/C4/Templates.pm b/C4/Templates.pm index dd54a6e3f41..f151f68f3e4 100644 --- a/C4/Templates.pm +++ b/C4/Templates.pm @@ -347,7 +347,7 @@ sub getlanguagecookie { -value => $language, -HttpOnly => 1, -expires => '+3y', - -sameSite => 'Lax', + -sameSite => C4::Context->preference('SameSiteSessionCookie'), -secure => ( C4::Context->https_enabled() ? 1 : 0 ), ); diff --git a/cataloguing/additem.pl b/cataloguing/additem.pl index 4d7b00b4b0e..6a80fbc1cb0 100755 --- a/cataloguing/additem.pl +++ b/cataloguing/additem.pl @@ -220,7 +220,7 @@ if ($load_template_submit || $unload_template_submit) { -value => $cookie_value, -HttpOnly => 1, -expires => '', - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); $cookie = [ $cookie, $template_cookie ]; @@ -347,7 +347,7 @@ if ($op eq "additem") { -value => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ), -HttpOnly => 1, -expires => '', - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); $cookie = [ $cookie, $last_created_item_cookie ]; diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc index 152feed293a..5bab762f06e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc @@ -12,7 +12,7 @@ function mergeAuth(authid, summary) { } window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring; } else { - Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: 'Lax' }); + Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); showMergingInProgress(); } } diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc index 13322d92e18..e2470b89823 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc @@ -1226,7 +1226,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr $( '#switch-editor' ).click( function() { if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return; - Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: 'Lax'} ); + Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); if ( state.backend == 'catalog' ) { window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt index 89b5775e077..6c683fbf783 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt @@ -325,7 +325,7 @@ MARC frameworks › Administration › Koha })); $("#select_display").on("change",function(){ var checked = $(this).prop("checked") ? 1: 0; - Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: 'Lax' }); + Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); this.form.submit(); }); }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/.cataloguing.pref.swp b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/.cataloguing.pref.swp new file mode 100644 index 0000000000000000000000000000000000000000..b9c114b6fb2655f08de72a9e64ddec589f3cf231 GIT binary patch literal 16384 zcmeHOON<;x8E%429P+?QPJo0eW6SH6b{=c9;Ecx;_GMUDd##b+ZB#0mg78A# z!4Z+%BYo4`-Bn$Gef8J>n%-vR+|ns_taQY{XTM=w`_cQY1C!^B>%V-!;EvdA#^$;s z`gC{O&rrLf<8Rx{`1DZ2^19dIelxZmO9a!?^0XLreWz@@QNUdhsWU(D+GXLEyPg$0 zA}n*OYrADX5G@f1*TfZ*N8It+vF)}?bbb5r^E){Mw>Ja#8b^;zSBQfHg$LOK_n*DJ z>BwiFGmtZoGmtZoGmtZoGmtZoGjN+R5czwJ&tT4X=y^Y)kMGDF-_)Ov>Feh+_utU> z&*;6dPxy9}cTbb%$H0=yUa`#!_?9qqJPpBj#a4~Glp8SA}gG<9f#R2 zi#mc?ss}Sw7aT3YT3*0f)S00-Tjg$Bu<4oN^oN<(Vy9+T=Z{R|IcFSh3cBLQO~=Ly z6}IP2K@hxiVXD9J7_lkLn9fS8$gh^myq@-%LXjd!q`ee0`PPdr;MFe2tY_aP{{bbG| zi##Uq{>Pw)YB$2=GG-t1wzwHG9o=Uvkw<5WM~8_Fgy{uV$PSBAyF~I#G1m*GSXjsP^bJ~WnRVfh*qW}vT2cnwtm}RsXN0H}-%u~wLw4n%IJK%oDHbHa5 zZ6{&fnD(5TBaDD^x;;;guHc5^`qYUpRM(OEJU^?gxgk=TrQAb8r0 zns0sdNiXQ~DAVZhq8o{T_MGWCaTkoW0papmdEpWq(>A|!d9)?vWy4X1*PiKkMs+;;u+%GzSJR@P_iQ7?wvF5^x}=8{y6J(ig9 zLfLHF#U@^^qc`)mzGqkRorgXDL?~d|JBQRkdX^I_J~y?<^O}u9eauBN>W`86fI@ja zwsK~69t$S|#dOHKa6!IwFtxH@&r(weBi?FJ_dxhw5T(pB-t=OeD$;OQ8sRPLfpulD zG_y4J2%~g^G1w_>rlfQOe%0-SV`Mt*9=>&;|2Cr?9C1C#6tSB zreG$FRD_E?JL+gJuct|GJ2Lf7WC{MW8Sucy%JwK8a0R-M@^-lkgMFEvepx>^jGMj) zx^@_nBToey2!8_}s3BM^NE&aJr0J3IQj+8(XV0C49o1??vrF4%$tq|jS~k?zh1QH+ zYGsDqxZ4x~8fs*UwP<4W3m5Erf?tv{y;327F~#W*$yUxDmXCjOIQN&lJwlkIKgM5n3RAvsgFR{tpPDw5> zl~AaTg4mqsNW37TC1l_Oc`$q`O)~cKe3ezED+l?OAsGw%Zp1fL!K1uc?DK9m72QQa zWYrEAHz|0VwGgWyZQ#yHswie%*Un{#9;N9*K8G{~6z@=akXk?SkqOLE>dTebix5ys zou^=LZjIJQ=Yq0!NmmhOqp~xyOJr}ZB8|6=&d=G+HF5rbReSQ}^o(7qy&QCtI_#wR zirC#NK0+Yo`n`z)aU zgp^e%q*n;-u%C3*V~X~K1p|p{U=Nks4&$?9M`2A$cCuoa|Ve5^1V^Z zPq$Ts4WpI4m4vs3Y^1-E(3-?wQPQuH@M)thfi=QZRQ5?;SU!@!-KLrwoCVTKltS@i z2+bEo8tiA(Jjfu)Y=SJnQloJ?OpK@9C8LE5Q)m0qU;3SZ!=vgHm)a+32pk!AP>Qhn zNz$Bl&19!)Zp710bxz#8DT-#(iJqc~uec;!$`g&LYn_r8;sB+3If2xr>WQj}gF?^A z7Cn{dGO$QEm>8IKO~r&RZBuw~;pju9nF@ZqpsF934B>V00|!(Cjk;Y<~c@^a9H-H;Gj2K`4+mztx&Hcaxen_jcB_xm{=)CU6s)wj_7o7E7iS@G7sW($fXn z=(FR@5WlLM%urT?_mZm%2^Fqk(B`drJkx1 zO#+4XsnHU(np#u-aF!GfhtEd3tH!GC3khZYcT9uGjvV^IiVkCLbMuOY0x?*?H~l;z TtTCb literal 0 HcmV?d00001 diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt index 7047d2d381a..d2f826af313 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt @@ -143,7 +143,7 @@ if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false; - Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: 'Lax' } ); + Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); var biblionumber = [% biblionumber || "null" | html %]; @@ -512,11 +512,12 @@ function PopupMARCFieldDoc(field) { function toggleMARCdocLinks(flag){ if( flag === true ){ $(".marcdocs").show(); - Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax' }); + + Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); $("#marcDocsSelect i").addClass('fa-check-square').removeClass('fa-square'); } else { $(".marcdocs").hide(); - Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); $("#marcDocsSelect i").removeClass('fa-check-square').addClass('fa-square'); } } @@ -525,12 +526,12 @@ function PopupMARCFieldDoc(field) { if( flag === true ){ $(".tagnum").show(); $(".subfieldcode").show(); - Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); $("#marcTagsSelect i").addClass('fa-check-square').removeClass('fa-square'); } else { $(".tagnum").hide(); $(".subfieldcode").hide(); - Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax' }); + Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); $("#marcTagsSelect i").removeClass('fa-check-square').addClass('fa-square'); } } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt index f720449c7f1..d2ac8004c91 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt @@ -295,7 +295,7 @@ }); $("#useadvanced").click(function(){ - Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } ); + Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); return true; }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt index ba471296014..f19064481a7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt @@ -236,7 +236,7 @@ }); $("#useadvanced").click(function(){ - Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } ); + Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); return true; }); }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt index dd7c26a7813..78a5c5a355d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt @@ -235,7 +235,7 @@ function SearchToHold(club_id) { var date = new Date(); date.setTime(date.getTime() + (10 * 60 * 1000)); - Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: 'Lax' }); + Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); location.href="/cgi-bin/koha/catalogue/search.pl"; } diff --git a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js b/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js index 313ae0f5ef9..29acf63c839 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js +++ b/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js @@ -3,7 +3,7 @@ function searchToOrder( basketno, vendorid ){ var cookieData = ""; date.setTime(date.getTime() + (10 * 60 * 1000)); cookieData += basketno + "/" + vendorid; - Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: 'Lax' }); + Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); } $(document).ready(function() { diff --git a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js b/koha-tmpl/intranet-tmpl/prog/js/checkouts.js index 4920eccb9d3..3e96707efc8 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js +++ b/koha-tmpl/intranet-tmpl/prog/js/checkouts.js @@ -265,7 +265,7 @@ $(document).ready(function() { $('#issues-table-load-delay').hide(); } $('#issues-table-load-immediately').on( "change", function(){ - Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: 'Lax' }); + Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); }); function RefreshIssuesTable() { diff --git a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js index b020966e588..abc08a3390a 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js +++ b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js @@ -160,6 +160,6 @@ function printx_window(print_type) { function searchToHold(){ var date = new Date(); date.setTime(date.getTime() + (10 * 60 * 1000)); - Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: 'Lax' }); + Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); location.href="/cgi-bin/koha/catalogue/search.pl"; } diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js b/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js index 4118c6b0131..957a87321c0 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js +++ b/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js @@ -52,10 +52,10 @@ function hideColumn(num) { if (!found) { valCookie.push(hide); var cookieString = valCookie.join("/"); - Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); } } else { - Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); } } @@ -88,7 +88,7 @@ function showColumn(num) { } if (found) { var cookieString = valCookie.join("/"); - Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); } } } @@ -113,7 +113,7 @@ function hideAllColumns() { $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide(); $("#hideall").prop("checked", true).parent().addClass("selected"); var cookieString = allColumns.join("/"); - Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); + Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); } $(document).ready(function () { diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt index eb1edd78bc0..68d89cf54f8 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt @@ -524,18 +524,18 @@ $(document).ready(function() { } }); form_serialized = $(this).serialize(); - Cookies.set("form_serialized", JSON.stringify( form_serialized ), { path: '/', sameSite: 'Lax' }); + Cookies.set("form_serialized", JSON.stringify( form_serialized ), { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); form_serialized_limits = [ $('#language-limit').val(), $('#branchloop').val(), $('#subtype_audience').val(), $('#subtype_content').val(), $('#subtype_format').val(), $('#subtype_additional').val(), $('#locloop').val() ]; - Cookies.set("form_serialized_limits", JSON.stringify( form_serialized_limits ),{ path: '/', sameSite: 'Lax' }); + Cookies.set("form_serialized_limits", JSON.stringify( form_serialized_limits ),{ path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); [% IF ( expanded_options ) %] - Cookies.set("search_path_code", 'exs', { path: '/', sameSite: 'Lax' }); + Cookies.set("search_path_code", 'exs', { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); [% ELSE %] - Cookies.set("search_path_code", 'ads', { path: '/', sameSite: 'Lax' }); + Cookies.set("search_path_code", 'ads', { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); [% END %] }); diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index e36db3d68b2..f48fa22552d 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -372,7 +372,7 @@ $cookie = $query->cookie( -expires => $jwt ? '+1d' : '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - -sameSite => 'Lax' + -sameSite => C4::Context->preference('SameSiteSessionCookie') ); $template->param(patronid => $patronid); -- 2.20.1