Bug 13694

Summary: Potential privacy issue with OPAC
Product: Koha Reporter: Kyle M Hall <kyle>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: kyle
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Kyle M Hall 2015-02-10 18:20:48 UTC
This was reported by a partner:

"So there is kind of a pretty big security bug, the logged in pages are
being cached by the browser, so on a public OPAC machine even after
the user has logged out you can click the back button to see all the
account pages they looked at. You can't actually do anything because
then it asks for login, but that's still a really major problem."

I'm not sure how or if we can fix this issue. I tried the solution here:
http://stackoverflow.com/questions/1341089/using-meta-tags-to-turn-off-caching-in-all-browsers

But it did not help at all in FireFox or Chrome.
Comment 1 Owen Leonard 2015-02-10 18:47:47 UTC

*** This bug has been marked as a duplicate of bug 5371 ***