From efddbf26044ad09aaf8048baecaae06b1e730a8d Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Tue, 24 Jun 2025 07:27:26 -0400 Subject: [PATCH] Bug 40224: Replace use of location.href with POST logout form The self-check module should use use POST for logouts instead of GET. Test Plan: 1) Enable WebBasedSelfCheck and SelfCheckInModule 2) Set SelfCheckTimeout and SelfCheckInTimeout to 10 seconds 3) Log in to each, observer the page is logged out after 10 seconds with not "op=logout" in the URL. Wait another 10 seconds, observe the page again refreshes with no "op=logout" in the URL. --- .../bootstrap/en/modules/sci/sci-main.tt | 9 +++++++-- .../bootstrap/en/modules/sco/sco-main.tt | 18 ++++++++++++------ koha-tmpl/opac-tmpl/bootstrap/js/timeout.js | 14 ++++++-------- opac/sco/sco-main.pl | 3 +-- 4 files changed, 26 insertions(+), 18 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt index 157752faa6b..73984fc16fa 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt @@ -198,6 +198,11 @@ +
+ [% INCLUDE 'csrf-token.inc' %] + +
+ [% INCLUDE 'opac-bottom.inc' %] @@ -286,8 +291,8 @@ const home_href = "/cgi-bin/koha/sci/sci-main.pl"; const sci_timer = new sc_timer({ "idle_timeout": idleTimeout, - "redirect_url": home_href - }); + "form_id": "logout_post_form", + }); window.sci_login_timer = sci_timer; sci_timer.start_timer(); } diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt index 81ed4bfef73..0ff43bc2de0 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt @@ -526,8 +526,14 @@ + +
+ [% INCLUDE 'csrf-token.inc' %] + +
+ [% INCLUDE 'opac-bottom.inc' %] [% BLOCK jsinclude %] [% INCLUDE 'datatables.inc' %] @@ -547,10 +553,10 @@ //NOTE: There can only be 1 sco_login_timer at a time if ( ! window.sco_login_timer ){ const idleTimeout = "[% Koha.Preference('SelfCheckTimeout') || 120 | html %]"; - const home_href = "/cgi-bin/koha/sco/sco-main.pl?op=logout"; + const home_href = "/cgi-bin/koha/sco/sco-main.pl"; const sco_timer = new sc_timer({ "idle_timeout": idleTimeout, - "redirect_url": home_href + "form_id": "logout_post_form", }); window.sco_login_timer = sco_timer; sco_timer.start_timer(); @@ -571,7 +577,7 @@ // alert("checkout_confirm('" + patronid + "') called for barcode '" + barcode + "'"); if (! barcode) { dofocus(); return false; } // no barcode if (barcode == "__KOHA_NEW_CIRC__") { // magic barcode - window.location.href='/cgi-bin/koha/sco/sco-main.pl?op=logout'; + $("#logout_post_form").submit(); return false; } return true; @@ -645,13 +651,13 @@ confirmModal("", _("Would you like to print a receipt?"), _("Print receipt and end session"), _("End session"), function(result) { if ( result && (Date.now() - confirmStart) < [% Koha.Preference('SelfCheckTimeout') | html %] ) { var win = window.open("/cgi-bin/koha/sco/printslip.pl?print=qslip"); - location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout'; + $("#logout_post_form").submit(); } else { - location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout'; + $("#logout_post_form").submit(); } }) [% ELSE %] - location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout'; + $("#logout_post_form").submit(); [% END %] return true; diff --git a/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js b/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js index 6c508d14c07..fe5d28abe33 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js +++ b/koha-tmpl/opac-tmpl/bootstrap/js/timeout.js @@ -1,13 +1,11 @@ class sc_timer { constructor(args) { const idle_timeout = args["idle_timeout"]; - const redirect_url = args["redirect_url"]; - if (idle_timeout) { - this.idle_timeout = idle_timeout; - } - if (redirect_url) { - this.redirect_url = redirect_url; - } + const form_id = args["form_id"]; + + this.idle_timeout = idle_timeout; + this.form_id = form_id; + this.idle_time = 0; } @@ -33,7 +31,7 @@ class sc_timer { _timer_increment() { this.idle_time++; if (this.idle_time >= this.idle_timeout) { - location.href = this.redirect_url; + $("#" + this.form_id).submit(); } } } diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index e1cc93d8026..939262410eb 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -93,8 +93,7 @@ my ( $op, $patronlogin, $patronpw, $barcodestr, $confirmed, $newissues, $load_ch my $jwt = $query->cookie('JWT'); -#FIXME: This needs to be changed to a POSTed logout... -if ( $op eq "logout" ) { +if ( $op eq "cud-logout" ) { $template->param( loggedout => 1 ); $query->param( patronlogin => undef, patronpw => undef ); undef $jwt; -- 2.39.5 (Apple Git-154)