Summary: | ISE after paying through opac payment plugin | ||
---|---|---|---|
Product: | Koha | Reporter: | Magnus Enger <magnus> |
Component: | OPAC | Assignee: | Kyle M Hall (khall) <kyle> |
Status: | CLOSED WORKSFORME | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | jonathan.druart, kyle |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 22543 | ||
Bug Blocks: |
Description
Magnus Enger
2021-06-18 11:32:10 UTC
This is caused by: commit d20c9ff5882377793d311f3a7a4621c4bdc31469 Bug 22543: Prevent "back and refresh attack" To recreate easily: * OPAC > Login > Privacy (/cgi-bin/koha/opac-privacy.pl) * MariaDB > delete from sessions; * Submit the form * Login again Notice the GET parameters (In reply to Jonathan Druart from comment #2) > To recreate easily: > * OPAC > Login > Privacy (/cgi-bin/koha/opac-privacy.pl) > * MariaDB > delete from sessions; > * Submit the form > * Login again > > Notice the GET parameters It isn't passing a 'userid' or 'password' field back, so the code from that bug should not be trigger. My question is; are you sure the Koha FQDN you are starting at is the same FQDN as the return URL? Check your opac base url. If you are starting from a url that does not match the opac base url, this exact scenario will happen because the cookie is for one FQDN but the redirect goes back to another! Even though two FQDNs can point to the same Koha instance, they will have separate cookies and thus logging into one will not mean you are logged in to the other! Hi Magnus, were you able to resolve this with Kyle's suggestion? (In reply to Katrin Fischer from comment #4) > Hi Magnus, were you able to resolve this with Kyle's suggestion? I don't think we have an ongoing problem with this, at least. Thanks for checking! |