Bugzilla – Attachment 162182 Details for
Bug 33259
Optionally set SameSite attribute of cookie to Strict
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 33259: Optionally set SameSite attribute of session cookie to Strict
Bug-33259-Optionally-set-SameSite-attribute-of-ses.patch (text/plain), 27.13 KB, created by
Martin Renvoize
on 2024-02-15 09:15:13 UTC
(
hide
)
Description:
Bug 33259: Optionally set SameSite attribute of session cookie to Strict
Filename:
MIME Type:
Creator:
Martin Renvoize
Created:
2024-02-15 09:15:13 UTC
Size:
27.13 KB
patch
obsolete
>From dc213a708e0b59cd83a4ebd0cccecab9f938e5c1 Mon Sep 17 00:00:00 2001 >From: Alex Buckley <alexbuckley@catalyst.net.nz> >Date: Thu, 23 Mar 2023 09:59:20 +1300 >Subject: [PATCH] Bug 33259: Optionally set SameSite attribute of session > cookie to Strict > >Note: The below test plan is assuming you are running the Mozilla Firefox >browser. > >Test plan: >1. Apply patches >2. Upgrade database >sudo koha-upgrade-schema <instance> >3. Confirm the new system preference 'SameSiteSessionCookie' is 'Lax' >4. Go to a staff client and OPAC page, right click, choose 'Inspect', go > to the 'Storage' tab, click on 'Cookies', click on 'CGISESSID' >5. Confirm 'SameSite' = 'Lax' >6. Change the 'SameSiteSessionCookie' to 'Strict' >7. Open a new private browser window. Go to a staff client and OPAC >page, right click, choose 'Inspect, go to the 'Storage' tab, click on >'Cookies', click on 'CGISESSID' >8. Repeat step 4 and confirm 'SameSite' = 'Strict' >9. Go to: Cataloguing > New record >10. Right click, click 'Inspect', go to the 'Console' tab, confirm there > are no JavaScript errors >11. Change 'SameSiteSessionCookie' to 'None' >12. Open a new private browser window, repeat step 4, and confirm the >'SameSite' = 'None' >13. Go to: Cataloguing > New record >14. Right click, click 'Inspect', go to the 'Console' tab, confirm there >are no JavaScript errors. > >Sponsored-by: Toi Ohomai Institute of Technology, New Zealand >Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk> >Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/Auth.pm | 18 +++++++++--------- > C4/InstallAuth.pm | 8 ++++---- > C4/Templates.pm | 2 +- > cataloguing/additem.pl | 4 ++-- > .../prog/en/includes/authorities_js.inc | 2 +- > .../prog/en/includes/cateditor-ui.inc | 2 +- > .../prog/en/modules/admin/marctagstructure.tt | 2 +- > .../admin/preferences/.cataloguing.pref.swp | Bin 0 -> 16384 bytes > .../prog/en/modules/cataloguing/addbiblio.tt | 11 ++++++----- > .../prog/en/modules/cataloguing/addbooks.tt | 2 +- > .../en/modules/cataloguing/cataloging-home.tt | 2 +- > .../prog/en/modules/clubs/clubs.tt | 2 +- > .../prog/js/acquisitions-menu.js | 2 +- > koha-tmpl/intranet-tmpl/prog/js/checkouts.js | 2 +- > .../intranet-tmpl/prog/js/members-menu.js | 2 +- > .../intranet-tmpl/prog/js/pages/batchMod.js | 8 ++++---- > .../bootstrap/en/modules/opac-advsearch.tt | 8 ++++---- > opac/sco/sco-main.pl | 2 +- > 18 files changed, 40 insertions(+), 39 deletions(-) > create mode 100644 koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/.cataloguing.pref.swp > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index ca4ee0c8af4..5193dcf661e 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -257,7 +257,7 @@ sub get_template_and_user { > -value => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie'), > )); > > #NOTE: This JWT should only be used by the self-check controllers >@@ -852,7 +852,7 @@ sub checkauth { > -value => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > )); > $loggedin = 1; > } >@@ -926,7 +926,7 @@ sub checkauth { > -value => $session->id, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie'), > )); > > $flags = haspermission( $userid, $flagsrequired ); >@@ -998,7 +998,7 @@ sub checkauth { > -value => $sessionID, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie'), > )); > my $pki_field = C4::Context->preference('AllowPKIAuth'); > if ( !defined($pki_field) ) { >@@ -1208,7 +1208,7 @@ sub checkauth { > -value => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie'), > )); > $info{'wrongip'} = 1; > } >@@ -1317,7 +1317,7 @@ sub checkauth { > -value => '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie'), > )); > } > >@@ -1488,7 +1488,7 @@ sub checkauth { > charset => 'utf-8', > cookie => $cookie, > 'X-Frame-Options' => 'SAMEORIGIN', >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > } > ), > $template->output; >@@ -1572,7 +1572,7 @@ sub check_api_auth { > -value => $session->id, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > return ( $return, $cookie, $session ); # return == 'ok' here > >@@ -1614,7 +1614,7 @@ sub check_api_auth { > -value => $sessionID, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > if ( $return == 1 ) { > my ( >diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm >index 56dd8e32602..d487c4e0e89 100644 >--- a/C4/InstallAuth.pm >+++ b/C4/InstallAuth.pm >@@ -262,7 +262,7 @@ sub checkauth { > -value => $session->id, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > $loggedin = 1; > $userid = $session->param('cardnumber'); >@@ -303,7 +303,7 @@ sub checkauth { > -value => $sessionID, > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > if ( $return == 2 ) { > >@@ -351,7 +351,7 @@ sub checkauth { > -HttpOnly => 1, > -expires => '', > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > } > if ($envcookie) { >@@ -395,7 +395,7 @@ sub checkauth { > -HttpOnly => 1, > -expires => '', > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > print $query->header( > -type => 'text/html; charset=utf-8', >diff --git a/C4/Templates.pm b/C4/Templates.pm >index fb7d3e5cb56..a5aafffac7f 100644 >--- a/C4/Templates.pm >+++ b/C4/Templates.pm >@@ -354,7 +354,7 @@ sub getlanguagecookie { > -value => $language, > -HttpOnly => 1, > -expires => '+3y', >- -sameSite => 'Lax', >+ -sameSite => C4::Context->preference('SameSiteSessionCookie'), > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), > ); > >diff --git a/cataloguing/additem.pl b/cataloguing/additem.pl >index b84d70cc50f..c2dbec96460 100755 >--- a/cataloguing/additem.pl >+++ b/cataloguing/additem.pl >@@ -220,7 +220,7 @@ if ($load_template_submit || $unload_template_submit) { > -value => $cookie_value, > -HttpOnly => 1, > -expires => '', >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > > $cookie = [ $cookie, $template_cookie ]; >@@ -348,7 +348,7 @@ if ($op eq "additem") { > -value => encode_base64url( freeze( { %{$item->unblessed}, itemnumber => undef } ) ), > -HttpOnly => 1, > -expires => '', >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > > $cookie = [ $cookie, $last_created_item_cookie ]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc >index b363ba106c9..2edc0cfc907 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc >@@ -12,7 +12,7 @@ function mergeAuth(authid, summary) { > } > window.location.href = "/cgi-bin/koha/authorities/merge.pl?authid=" + authid + "&authid=" + alreadySelected.authid + refstring; > } else { >- Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: 'Lax' }); >+ Cookies.set('auth_to_merge', JSON.stringify({ 'authid': authid, 'summary': summary }), { 'path' : '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > showMergingInProgress(); > } > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc >index 2ff15873b0c..3f08bb87213 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc >@@ -979,7 +979,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr > function changeEditor() { > if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return; > >- Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: 'Lax'} ); >+ Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "basic", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); > > if ( state.backend == 'catalog' ) { > window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt >index 6f69159cb07..8d7a04667dd 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt >@@ -339,7 +339,7 @@ > })); > $("#select_display").on("change",function(){ > var checked = $(this).prop("checked") ? 1: 0; >- Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: 'Lax' }); >+ Cookies.set("marctagstructure_selectdisplay", checked, { sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > this.form.submit(); > }); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/.cataloguing.pref.swp b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/.cataloguing.pref.swp >new file mode 100644 >index 0000000000000000000000000000000000000000..b9c114b6fb2655f08de72a9e64ddec589f3cf231 >GIT binary patch >literal 16384 >zcmeHOON<;x8E%429P+?QPJo0eW6SH6b{=c9;Ecx;_GMUDd##<d;}{#Krn_dQwLRVK >ze(da63d8~tg>b+ZB#0mg<p4qg@szl5iG)B3B3yC+B!a|=NKue@36X^Fud42u>78A# >z!4Z+%BYo4`-Bn$Gef8J>n%-vR+|ns_taQY{XTM=w`_cQY1C!^B>%V-!;EvdA#^$;s >z`gC{O&rrLf<8Rx{`1DZ2^19dIelxZmO9a!?^0XLreWz@@QNUdhsWU(D+GXLEyPg$0 >zA}n*OYrADX5G@f1*TfZ*N8It+vF)}?bbb5r^E){Mw>Ja#8b^;zSBQfHg$LOK_n*DJ >z>BwiFGmtZoGmtZoGmtZoGmtZoGjN+R5czwJ&tT4X=y^Y)kMGDF-_)Ov>Feh+_utU> >z&*<yl$lQNj-*4#auVwDPQ=ixMab63M$e}Oihn#_&ft-Pyft-Pyft-Pyft-Pyft-Py >zft-Pyf&YR5ZW+cs==V8FwD%iElK=npJ%;gn;8(!&!1sY`z(wFN@B!c-_Zh~^z|Vl^ >zfJ;CFm;~+z{&}xqyaZeao&?r_<G?{+AMhs({1f0QpbmTx_}bluaRoR9d<fVB{QTW` >zKJZn*1<nF>;6dPxy9}cTbb%$H0=yUa`#!_?9q<hB{GEpJQ{Xw^37`dh0@w%K3H<F{ >zhVcsUL*Qv30xkj%1NQ)T06*Sq7zN<<J(x4_67WsnY2XTQ8u%BA7_R}p1zrUHjiSnn >zz_);}1K$J3#Peq}MGZFeDKdJ8p~@CSi^onh@5Oi>qJPpBj#a4~Glp8SA}gG<9f#R2 >zi#mc?ss}Sw7aT3YT3*0f)S00-Tjg$Bu<4oN^oN<(Vy9+T=Z{R|IcFSh3cBLQO~=Ly >z6}IP2K@hxiVXD9J7_lkLn9fS<a6<@I<E#TwPfT>8$gh^my<V^6cxI{XZIrt_Fw061 >zn_kh7BH^#gBvh#rb)AVijn3vt$Ync>q@-%LXjd!q`ee0`PPdr;MFe2tY_aP{{bbG| >zi##Uq{>Pw)YB$2=GG-t1wzwHG9o=Uvkw<5WM~8_Fgy{uV$PSBAyF~I#G1m*GSX<yL >z+zn;PaA7(5>jsP^bJ~WnRVfh*qW}vT2cnwtm}RsXN0H}-%u~wLw4n%IJK%oDHbHa5 >zZ6{<t*dwa_059n<I}%+M`nD^W!<)hhOX<^zef6nS87nM!?nK1Gj@KJqAk}2L${M(3 >z=pOoDc03!e_Y5Sa>&fnD(5TBaDD^x;;;guHc5^`qYUpRM(OEJU^?gxgk=TrQAb8r0 >zns0sdNiXQ~DAVZhq8o{T_MGWCaTkoW0<SAKV2zZ!u9&Mq=W#N{hA$FfSSWdiVMnQZ >zBUdBd#9L0#mN*EoX)Ix}W}h8$qT`Ia7CY3Aj+Z7gA{CZg(}}T<$O^PP$MJf27fNk= >zxuBd~iEVSeD3=XS99pv-_85;N5A%mPaGXB#J)gxs<9h8ao8GzFX2A;<t@k!dZFwW& >zGq%fxo`pDap+~wG*&`j{vN)s})BNR3hi9k+#tuyTDW#Aqq!qVnq&FEpWM4RJ3LfWr >zk=@c3k#WlkM2Ho~+Ud8>papmdEpWq(>A|!d9)?vWy4X1*PiKkMs<MfRkvoYB&Z{@t >zM6gJm!%UmP*-)?nxuYsxWD_;NUc-j>+;;u+%GzSJR@P_iQ7?wvF5^x}=8{y6J(ig9 >zLfLHF#U@^^qc`)mzGqkRorgXDL?~d|JBQRkdX^I_J~y?<^O}u9eauBN>W`86fI@ja >zwsK~69t$S|#dOHKa6!IwFtxH@&r(weBi?FJ_dxhw5T(pB-t=OeD$;OQ8sRPLfpulD >zG_y4J2%~g^G1w_>rlfQOe%0-<N;<TX6+^XC-<gF>SV`Mt*9=>&;|2Cr?9C1C#6tSB >zreG$FRD_E?JL+gJuct|GJ2Lf7WC{MW8Sucy%JwK8a0R-M@^-lkgMFEvepx>^jGMj) >zx^@_nBToey2!8_}s3BM^NE&aJr0J3IQj+8(XV0C49o1??vrF4%$tq|jS~k?zh1QH+ >zYGsDqxZ4x~<Q?^AN=KNwo1Fzs5xW{Y$Vt2F^KE+ENI8aONvB1_BoydiufaEj^4N&$ >z#L_~hZ9$s4kZ;i1g9I)ExH832=T9xe-h&U#4YxKp?2?u23hE&&JA&boksNIxx|aGb >z<>8fs*UwP<4W3m5Erf?tv{y;327F~#W*$yUxDmXC<w1vGJ0Xv9O=0ZIO-rWp?CB*L >z`?c&%NGNScCUk%St~G;losBnS0|^v~r0d(ycxNqFW^nY0^i-+li_%6K@-+Rr(Q1!3 >z1?o|=dR?@hV+j`Js-#0?DJ=*d_F0ejrAbis0FeN9`qD9LYlnj)gZ8jv`&(TRi9XoZ >zw=fJ_gmAN|FiLd??kYPMON3@%OAC*%q?H6H6xYBkDLqIOSSpCp*lpHtOvp&{B;&Mw >zxH)$1l3kdn5RI*dHt31;$xcN_2WiShzJ3rVgkBt&A}e<?wu%gjs?mTgIShi8;pA`R >zu?_iDgW4sZB10@-q-XN4rDVfajRUM1c<TbGoY%D@IFc${LSPyL?W-D;|38l0^g8lY >z%Kww!-+zPr{yV@Ifpwq`OaXg=SCQMl0DK$xJYWKAz{i2RfIlF&{{`?}fO7v=kk|ha >z_yKSg_%m|)mw{)282A*h089Yakkj{oRp2<lfH#rPe+Bpg@B~l;?gm~(ZvO({0_TA* >zBbTTA{(Zn6;7R1|j{`N}KHx9N-+v7Rz(wF$<m^uYhk*S6aquPLA^+qI{J$7Tb~7E} >z2PxQxtz3JQ9ZrlrC9!OhG8E3%1-t_VeKpaoBQT~yPOXf;WdNAiC-kNeQeKmGR)v}L >z;6AJhrC=UqP?<<7al@nD5myoYC4nj)fngD*QaBOuHiR0n=TbO?vPtfl%F(trkhrZb >zHK^Ba2VV1#+6mKc^;s9yG22JTBV7fJTpoB4vd=tdi%2DFd`Lz;Vj9j2XUsC;uaZ!g >z*JeLjWuL_Nk%Nu1b0?P;mlvj|*vR>jOIQ<G>N&lJwlkIKgM5n3RAvsgFR{tpPDw5> >zl~AaTg4mqsNW37TC1l_Oc`$q`O)~cKe3ezED+l?OAsGw%Zp1fL!K1uc?DK9m72QQa >zWYrEAHz|0VwGgWyZQ#yHswie%*Un{#9;N9*K8G{~6z@=akXk?SkqOLE>dTebix5ys >zou^=LZjIJQ=Yq0!NmmhOqp~xyOJr}ZB8|6=&d=G+HF5rbReSQ}^o(7qy&QCtI_#wR >zirC#NK0<ty=-x`*Pb3<r`i^P3Z?W=&Ht5u?*MFr0Teg522pc3@_LN4>+Yo`n`z)aU >zgp^e%q*n;-u%C3*V~X~K1p|p{U=Nks4&$<bPnRRUu6_>?9M`2A$cCuoa|Ve5^1V^Z >zPq$Ts4WpI4m4vs3Y^1-E(3-?wQPQuH@M)thfi=QZRQ5?;SU!@!-KLrwoCVTKltS@i >z2+bEo8tiA(Jjfu)Y=SJnQloJ?OpK@9C8LE5Q)m0qU;3SZ!=vgHm)a+32pk!AP>Qhn >zNz$Bl&19!)Zp710bxz#8DT-#(iJqc~uec;!$`g&LYn_r8;sB+3If2xr>WQj}gF?^A >z7Cn{dGO$QEm>8IKO~r&RZBuw~;pju9nF@ZqpsF934B>V00|!(Cjk;Y<QHUiR8~FuX >z7dgW!yI4?#?Mek6vvTanLEgmiA-JffE`DDuOpbDs=*d79<zkjx2ryGwmE$&~5E)7q >z><~c@^a9H-H;Gj2K`4+mztx&Hcaxen_jcB_xm{=)CU6s)wj_7o7E7iS@G7sW($fXn >z=(FR@5WlLM%u<sJ<C<8ZS%vb2rf@9`G_DD!CioiPVn>rT?_mZm%2^Fqk(B`drJkx1 >zO#+4XsnHU(np#u-aF!GfhtEd3tH!GC3khZYcT9uGjvV^IiVkCLbMuOY0x?*?H~l;z >TtTC<dqwY{EZ0ez3d5!-7cUB>b > >literal 0 >HcmV?d00001 > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt >index b4d1015100f..4fad70ba943 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt >@@ -43,7 +43,7 @@ > > if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false; > >- Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: 'Lax' } ); >+ Cookies.set( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); > > var biblionumber = [% biblionumber || "null" | html %]; > >@@ -543,11 +543,12 @@ $(document).ready(function(){ > function toggleMARCdocLinks(flag){ > if( flag === true ){ > $(".marcdocs").show(); >- Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax' }); >+ >+ Cookies.set("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > $("#marcDocsSelect i").addClass('fa-check-square').removeClass('fa-square'); > } else { > $(".marcdocs").hide(); >- Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax' }); >+ Cookies.set("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > $("#marcDocsSelect i").removeClass('fa-check-square').addClass('fa-square'); > } > } >@@ -556,12 +557,12 @@ $(document).ready(function(){ > if( flag === true ){ > $(".tagnum").show(); > $(".subfieldcode").show(); >- Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: 'Lax' }); >+ Cookies.set("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > $("#marcTagsSelect i").addClass('fa-check-square').removeClass('fa-square'); > } else { > $(".tagnum").hide(); > $(".subfieldcode").hide(); >- Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: 'Lax' }); >+ Cookies.set("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > $("#marcTagsSelect i").removeClass('fa-check-square').addClass('fa-square'); > } > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt >index 598ec9d05dc..0855dea8dd4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt >@@ -305,7 +305,7 @@ > }); > > $("#useadvanced").click(function(){ >- Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } ); >+ Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); > return true; > }); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt >index 7cf87d2ee9a..10caa96f377 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt >@@ -250,7 +250,7 @@ > }); > > $("#useadvanced").click(function(){ >- Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: 'Lax' } ); >+ Cookies.set( "catalogue_editor_[% logged_in_user.borrowernumber | html %]", "advanced", { expires: 365, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' } ); > return true; > }); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt >index ad03620b63d..33345d059d7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt >@@ -241,7 +241,7 @@ > function SearchToHold(club_id) { > var date = new Date(); > date.setTime(date.getTime() + (10 * 60 * 1000)); >- Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: 'Lax' }); >+ Cookies.set("holdforclub", club_id, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > location.href="/cgi-bin/koha/catalogue/search.pl"; > } > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js b/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js >index 313ae0f5ef9..29acf63c839 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/acquisitions-menu.js >@@ -3,7 +3,7 @@ function searchToOrder( basketno, vendorid ){ > var cookieData = ""; > date.setTime(date.getTime() + (10 * 60 * 1000)); > cookieData += basketno + "/" + vendorid; >- Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: 'Lax' }); >+ Cookies.set("searchToOrder", cookieData, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > } > > $(document).ready(function() { >diff --git a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js b/koha-tmpl/intranet-tmpl/prog/js/checkouts.js >index 3ab2ec65928..8653b845f9a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/checkouts.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/checkouts.js >@@ -748,7 +748,7 @@ $(document).ready(function() { > $('#issues-table-load-delay').hide(); > } > $('#issues-table-load-immediately').on( "change", function(){ >- Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: 'Lax' }); >+ Cookies.set("issues-table-load-immediately-" + script, $(this).is(':checked'), { expires: 365, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > }); > > // Don't load relatives' issues table unless it is clicked on >diff --git a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js >index c3989d98aa7..b322c559a35 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js >@@ -146,6 +146,6 @@ function export_barcodes() { > function searchToHold(){ > var date = new Date(); > date.setTime(date.getTime() + (10 * 60 * 1000)); >- Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: 'Lax' }); >+ Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > location.href="/cgi-bin/koha/catalogue/search.pl"; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js b/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js >index 128c37909f7..17f17c6c292 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js >@@ -52,10 +52,10 @@ function hideColumn(num) { > if (!found) { > valCookie.push(hide); > var cookieString = valCookie.join("/"); >- Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); >+ Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > } > } else { >- Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: 'Lax' }); >+ Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > } > } > >@@ -88,7 +88,7 @@ function showColumn(num) { > } > if (found) { > var cookieString = valCookie.join("/"); >- Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); >+ Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > } > } > } >@@ -113,7 +113,7 @@ function hideAllColumns() { > $("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide(); > $("#hideall").prop("checked", true).parent().addClass("selected"); > var cookieString = allColumns.join("/"); >- Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' }); >+ Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > } > > $(document).ready(function () { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >index 21d4d1b0251..c88e7d216cc 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >@@ -519,18 +519,18 @@ $(document).ready(function() { > } > }); > form_serialized = $(this).serialize(); >- Cookies.set("form_serialized", JSON.stringify( form_serialized ), { path: '/', sameSite: 'Lax' }); >+ Cookies.set("form_serialized", JSON.stringify( form_serialized ), { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > form_serialized_limits = [ > $('#language-limit').val(), $('#branchloop').val(), > $('#subtype_audience').val(), $('#subtype_content').val(), > $('#subtype_format').val(), $('#subtype_additional').val(), > $('#locloop').val() > ]; >- Cookies.set("form_serialized_limits", JSON.stringify( form_serialized_limits ),{ path: '/', sameSite: 'Lax' }); >+ Cookies.set("form_serialized_limits", JSON.stringify( form_serialized_limits ),{ path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > [% IF ( expanded_options ) %] >- Cookies.set("search_path_code", 'exs', { path: '/', sameSite: 'Lax' }); >+ Cookies.set("search_path_code", 'exs', { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > [% ELSE %] >- Cookies.set("search_path_code", 'ads', { path: '/', sameSite: 'Lax' }); >+ Cookies.set("search_path_code", 'ads', { path: '/', sameSite: '[% Koha.Preference('SameSiteSessionCookie') %]' }); > [% END %] > }); > >diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl >index 45d46b7d473..324f42ce516 100755 >--- a/opac/sco/sco-main.pl >+++ b/opac/sco/sco-main.pl >@@ -382,7 +382,7 @@ $cookie = $query->cookie( > -expires => $jwt ? '+1d' : '', > -HttpOnly => 1, > -secure => ( C4::Context->https_enabled() ? 1 : 0 ), >- -sameSite => 'Lax' >+ -sameSite => C4::Context->preference('SameSiteSessionCookie') > ); > > $template->param(patronid => $patronid); >-- >2.43.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 33259
:
148577
|
148578
|
148579
|
148580
|
148589
|
148590
|
150259
|
150557
|
150558
|
150559
|
150560
|
154142
|
154143
|
154144
|
154145
|
160786
|
160787
|
160788
|
160789
|
160790
|
160791
|
160792
|
160793
|
162181
|
162182
|
162183
|
162184
|
162185
|
162186
|
163066
|
163067
|
163068
|
163069
|
163070
|
163071