@@ -, +, @@ - Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl - Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1 - Click "Back", you are taken to /cgi-bin/koha/opac-user.pl - Reload the page, you see an error like "Confirm new submission of form" - Reload the page again and confirm the submission of the form - You are now logged in to the OPAC again! - Log out again - Apply this patch - Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl - Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1 - Click back, you are taken to /cgi-bin/koha/opac-user.pl - No matter how many times you reload /cgi-bin/koha/opac-user.pl, you should not see anything other than the login form. - Check that Self Check Out still works as it should, by making sure you have a user with self_check permissions, then setting WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and AutoSelfCheckPass appropriately. Then visit /cgi-bin/koha/sco/sco-main.pl and verify everything works as expected. --- C4/Auth.pm | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -1209,6 +1209,18 @@ sub checkauth { ); } + # In case, that this request was a login attempt, we want to prevent that users can repost the opac login + # request. We therefore redirect the user to the requested page again without the login parameters. + # See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get + if ( $type eq "opac" && $query->param('koha_login_context') && $query->param('koha_login_context') ne 'sco' && $query->param('password') && $query->param('userid') ) { + my $uri = URI->new($query->url(-relative=>1, -query_string=>1)); + $uri->query_param_delete('userid'); + $uri->query_param_delete('password'); + $uri->query_param_delete('koha_login_context'); + print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other'); + exit; + } + track_login_daily( $userid ); return ( $userid, $cookie, $sessionID, $flags ); --