Bug 22585

Summary: Fix remaining double-escaped CAS links
Product: Koha Reporter: Justin Rittenhouse <jrittenh>
Component: AuthenticationAssignee: Justin Rittenhouse <jrittenh>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: dpavlin, fridolin.somers, jonathan.druart+koha, katrin.fischer, lucas, nick, victor
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.01,18.11.07
Bug Depends on: 21973    
Bug Blocks:    
Attachments: remove double-escape for CAS URL
Bug 22585: remove double-escape for CAS URL
Bug 22585: (follow-up) Fix additional occurences
Bug 22585: remove double-escape for CAS URL
Bug 22585: (follow-up) Fix additional occurences

Description Justin Rittenhouse 2019-03-26 20:56:44 UTC
Created attachment 87036 [details] [review]
remove double-escape for CAS URL

The return URL that is part of the link to CAS login is double-escaped on the staff login page.  This means that %3A%2F%2F is converted to %253A%252F%252F.

It appears that this is the same issue as bug 21973 but in the staff intranet template.  I have attached an identical patch for the intranet auth.tt file.
Comment 1 Jonathan Druart 2019-05-31 17:51:56 UTC
*** Bug 23026 has been marked as a duplicate of this bug. ***
Comment 2 Nick Clemens 2019-06-06 14:32:59 UTC
Created attachment 90376 [details] [review]
Bug 22585: remove double-escape for CAS URL

The return URL that is part of the link to CAS login is double-escaped on the staff login page.

It appears that this is the same issue as bug 21973 but in the staff intranet template.  I have attached an identical patch for the intranet auth.tt file.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 3 Katrin Fischer 2019-06-09 21:12:10 UTC
With this patch, there remains:

koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt:                                            <li><a href="[% casServer.value | url %]">

Can you please check if this needs to be changed as well?
Comment 4 Jonathan Druart 2019-06-10 13:31:19 UTC
It comes from:

C4/Auth.pm

1310             foreach my $key ( keys %$casservers ) {
1311                 push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
1312             }

So you are right Katrin, it must not be filtered.
Comment 5 Nick Clemens 2019-06-10 13:42:36 UTC
Created attachment 90456 [details] [review]
Bug 22585: (follow-up) Fix additional occurences
Comment 6 Jonathan Druart 2019-06-10 14:29:15 UTC
This patch is for OPAC and so more a follow-up for bug 21973. But I am not sure it would make sense to open a third report for it.
Comment 7 Nick Clemens 2019-06-10 14:44:27 UTC
(In reply to Jonathan Druart from comment #6)
> This patch is for OPAC and so more a follow-up for bug 21973. But I am not
> sure it would make sense to open a third report for it.

Maybe just retitle this one as "Fix remaning CAS links"?
Comment 8 Katrin Fischer 2019-06-13 06:10:57 UTC
Created attachment 90554 [details] [review]
Bug 22585: remove double-escape for CAS URL

The return URL that is part of the link to CAS login is double-escaped on the staff login page.

It appears that this is the same issue as bug 21973 but in the staff intranet template.  I have attached an identical patch for the intranet auth.tt file.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Katrin Fischer 2019-06-13 06:11:00 UTC
Created attachment 90555 [details] [review]
Bug 22585: (follow-up) Fix additional occurences

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 10 Martin Renvoize 2019-06-13 11:07:42 UTC
Nice work!

Pushed to master for 19.11.00
Comment 11 Fridolin Somers 2019-06-17 07:59:54 UTC
Pushed to 19.05.x for 19.05.01
Comment 12 Lucas Gass 2019-06-26 14:50:02 UTC
backported to 18.11.x for 18.11.07