Summary: | Advanced Editor is not loaded if X-Content-Type-Options: nosniff | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomáš Wünsch <fraktik> |
Component: | Cataloging | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | minor | ||
Priority: | P4 | CC: | jonathan.druart, m.de.rooy, marjorie.barry-vila, nick |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
printscreen of security failure
printscreen from console - http needed on https connection Bug 23874: Fix advanced editor if nosniff is set |
Description
Tomáš Wünsch
2019-10-22 13:51:36 UTC
Created attachment 94565 [details]
printscreen of security failure
Created attachment 94578 [details]
printscreen from console - http needed on https connection
temporary solution: - about:config in FF - security.mixed_content.block_active_content setup to "false". I can't replicate this issue on 18.11.10 - any more clues on where the hardcoded bit is hiding? Not sure how to help. You can login into our 19.05: https://demo.koha.cz/ user demo passwd demo (In reply to Tomáš Wünsch from comment #5) > Not sure how to help. You can login into our 19.05: > https://demo.koha.cz/ > user demo > passwd demo Hi Tomas, the Advanced Editor appears to be turned off on that one and I don't have access to the system preferences with that login. (In reply to Katrin Fischer from comment #6) > (In reply to Tomáš Wünsch from comment #5) > > Not sure how to help. You can login into our 19.05: > > https://demo.koha.cz/ > > user demo > > passwd demo > > Hi Tomas, the Advanced Editor appears to be turned off on that one and I > don't have access to the system preferences with that login. I've tested in the Catalyst demo that uses https, but the Advanced editor loads: https://demo-intra.mykoha.co.nz/cgi-bin/koha/cataloguing/editor.pl#new/ (https://koha-community.org/demo/) Tested in Firefox on Ubuntu. Did I miss something form the test plan? Created attachment 95274 [details] [review] Bug 23874: Fix advanced editor if nosniff is set Hi Tomáš, can you try this patch please? I am pretty sure we will need to adjust much more occurrences. (In reply to Jonathan Druart from comment #8) > Created attachment 95274 [details] [review] [review] > Bug 23874: Fix advanced editor if nosniff is set Hi Jonathan, I am curious why this makes a difference? The fact that you ask to return JSON does not make it a different GET request? Marcel Just for reference: jQuery.get( url [, data ] [, success ] [, dataType ] ) Hum I think my tests were wrong yesterday. I thought I saw a content type text/html before this patch, then json. But I cannot replicate this. |