Bug 26069

Summary: Twitter share button leaks information to Twitter
Product: Koha Reporter: x.schindel
Component: OPACAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: aleisha, amit.gupta, amitddng135, jonathan.druart, kelly, lucas, victor
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
20.11.00, 20.05.04, 19.11.10, 19.05.15
Attachments: Bug 26069: Pass correct URL to twitter
Bug 26069: Pass correct URL to twitter
Bug 26069: Pass correct URL to twitter
Bug 26069: Pass correct URL to twitter

Description x.schindel 2020-07-27 09:17:42 UTC
If any share button is active on the details page to some media (must not necessarily be the Twitter button), then requests are sent to Twitter which contain information about the currently displayed media in the referer header

Example: .../cgi-bin/koha/opac-detail.pl?biblionumber=21&query_desc=kw%2Cwrdl%3A%20sch*).
 
This is not acceptable from a data privacy point of view.

Instead of using the Twitter script a simple link behind the Twitter share button should be used (as already done e.g. for sharing with Facebook or LinkedIn).
Comment 1 Jonathan Druart 2020-08-21 14:09:28 UTC
Created attachment 108824 [details] [review]
Bug 26069: Pass correct URL to twitter

We don't provide the url of the detail page so the twitter JS code
retrieve the current location, with the search terms.

Test plan:
Do a search
Click on a result
Click on the twitter button and confirm that the link only contain
biblionumber=x in the parameter
Comment 2 Owen Leonard 2020-08-21 15:12:11 UTC
(In reply to Jonathan Druart from comment #1)

> Click on the twitter button and confirm that the link only contain
> biblionumber=x in the parameter

I'm still getting the "query_desc" part of the URL:

https://twitter.com/intent/tweet?url=http%3A%2F%2F127.0.0.1%3A8080%2Fcgi-bin%2Fkoha%2Fopac-detail.pl%3Fbiblionumber%3D2358%26query_desc%3Dkw%252Cwrdl%253A%2520bark
Comment 3 x.schindel 2020-08-21 15:26:23 UTC
Adjusting the URL used for the Twitter link will not solve the issue.

As long as the following script-tag

   <script id="twitter-wjs" src="//platform.twitter.com/widgets.js"></script>

is part of the page there will be (a dark) request to Twitter which contains the number of the displayed media in the referer header.
Comment 4 Jonathan Druart 2020-08-21 15:31:19 UTC
Created attachment 108832 [details] [review]
Bug 26069: Pass correct URL to twitter

We don't provide the url of the detail page so the twitter JS code
retrieve the current location, with the search terms.

Test plan:
Do a search
Click on a result
Click on the twitter button and confirm that the link only contain
biblionumber=x in the parameter
Comment 5 Amit Gupta 2020-08-25 17:04:13 UTC
Created attachment 109121 [details] [review]
Bug 26069: Pass correct URL to twitter

Test plan:
Do a search
Click on a result
Click on the twitter button and confirm that the link only contain
biblionumber=x in the parameter
Comment 6 Katrin Fischer 2020-08-26 21:14:36 UTC
Created attachment 109206 [details] [review]
Bug 26069: Pass correct URL to twitter

We don't provide the url of the detail page so the twitter JS code
retrieve the current location, with the search terms.

Test plan:
Do a search
Click on a result
Click on the twitter button and confirm that the link only contain
biblionumber=x in the parameter

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Jonathan Druart 2020-08-27 07:53:31 UTC
(In reply to x.schindel from comment #3)

Can you confirm it now works as you expected?
Comment 8 Katrin Fischer 2020-08-27 08:05:32 UTC
I verified it using the dev tools in the broswer - I saw the request to Twitter without the patch, but not with it.
Comment 9 Amit Gupta 2020-08-27 08:07:44 UTC
I applied the patch on my development machine and it's worked OK.
Comment 10 Jonathan Druart 2020-08-31 14:21:03 UTC
Pushed to master for 20.11, thanks to everybody involved!
Comment 11 Lucas Gass 2020-09-04 21:04:19 UTC
backported to 20.05.x for 20.05.04
Comment 12 Lucas Gass 2020-09-04 21:05:24 UTC
*** Bug 24520 has been marked as a duplicate of this bug. ***
Comment 13 Aleisha Amohia 2020-09-10 04:52:47 UTC
backported to 19.11.x for 19.11.10
Comment 14 Victor Grousset/tuxayo 2020-09-20 18:50:18 UTC
Backported to 19.05.x branch for 19.05.15

(triple checked that the strings were untouched)