Bug 22542

Summary: Back browser should not allow to see other patrons details (see bug 5371)
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: fridolin.somers, jonathan.druart, katrin.fischer, martin.renvoize, nick, roger.grossmann
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5371
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05, 18.05.12, 17.11.18
Bug Depends on:    
Bug Blocks: 23467    
Attachments: Bug 22542: Force back button to display personal data
Bug 22542: Force back button to display personal data
Bug 22542: Force back button to display personal data

Description Katrin Fischer 2019-03-20 02:36:30 UTC
With bug 5371 we fixed OPAC pages to not show a former patron's details when using the back button in the browser.

I noticed that not all pages are using force_no_caching => 1 now, notably opac-illrequests.pl doesn't appear to use it, some others like opac-suggestions neither. 

I think we should check if that is ok or if we need to fix files again. Can't confirm right now if it works ok all over.
Comment 1 Jonathan Druart 2019-03-21 17:54:37 UTC
Created attachment 86858 [details] [review]
Bug 22542: Force back button to display personal data

This is a follow-up of bug 5371

The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching

This must be a test somehwere to prevent further regressions.
Comment 2 Katrin Fischer 2019-04-12 13:26:32 UTC
Created attachment 87907 [details] [review]
Bug 22542: Force back button to display personal data

This is a follow-up of bug 5371

The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching

This must be a test somehwere to prevent further regressions.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Katrin Fischer 2019-04-12 13:27:31 UTC
Should we make the same change for other pages as well?

Thinking of, but not sure, as those pages don't require login necessarily:

opac-password-recovery
opac-registration-verify
opac-suggestions
Comment 4 Chris Cormack 2019-04-15 00:56:25 UTC
Created attachment 87974 [details] [review]
Bug 22542: Force back button to display personal data

This is a follow-up of bug 5371

The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching

This must be a test somehwere to prevent further regressions.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 5 Martin Renvoize 2019-04-26 16:29:43 UTC
Pushed to 18.11.x for 18.11.05
Comment 6 Fridolin Somers 2019-04-30 06:15:27 UTC
Pushed to 18.05.x for 18.05.12

Pushed to 17.11.x for 17.11.18
Comment 7 Nick Clemens 2019-05-02 13:53:06 UTC
Awesome work all!

Pushed to master for 19.05