Summary: | Twitter share button leaks information to Twitter | ||
---|---|---|---|
Product: | Koha | Reporter: | x.schindel |
Component: | OPAC | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | aleisha, amit.gupta, amitddng135, jonathan.druart, kelly, lucas, victor |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
20.11.00, 20.05.04, 19.11.10, 19.05.15
|
|
Attachments: |
Bug 26069: Pass correct URL to twitter
Bug 26069: Pass correct URL to twitter Bug 26069: Pass correct URL to twitter Bug 26069: Pass correct URL to twitter |
Description
x.schindel
2020-07-27 09:17:42 UTC
Created attachment 108824 [details] [review] Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter (In reply to Jonathan Druart from comment #1) > Click on the twitter button and confirm that the link only contain > biblionumber=x in the parameter I'm still getting the "query_desc" part of the URL: https://twitter.com/intent/tweet?url=http%3A%2F%2F127.0.0.1%3A8080%2Fcgi-bin%2Fkoha%2Fopac-detail.pl%3Fbiblionumber%3D2358%26query_desc%3Dkw%252Cwrdl%253A%2520bark Adjusting the URL used for the Twitter link will not solve the issue. As long as the following script-tag <script id="twitter-wjs" src="//platform.twitter.com/widgets.js"></script> is part of the page there will be (a dark) request to Twitter which contains the number of the displayed media in the referer header. Created attachment 108832 [details] [review] Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter Created attachment 109121 [details] [review] Bug 26069: Pass correct URL to twitter Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter Created attachment 109206 [details] [review] Bug 26069: Pass correct URL to twitter We don't provide the url of the detail page so the twitter JS code retrieve the current location, with the search terms. Test plan: Do a search Click on a result Click on the twitter button and confirm that the link only contain biblionumber=x in the parameter Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> (In reply to x.schindel from comment #3) Can you confirm it now works as you expected? I verified it using the dev tools in the broswer - I saw the request to Twitter without the patch, but not with it. I applied the patch on my development machine and it's worked OK. Pushed to master for 20.11, thanks to everybody involved! backported to 20.05.x for 20.05.04 *** Bug 24520 has been marked as a duplicate of this bug. *** backported to 19.11.x for 19.11.10 Backported to 19.05.x branch for 19.05.15 (triple checked that the strings were untouched) |