Bug 40224

Summary: Replace use of location.href with POST logout form
Product: Koha Reporter: Kyle M Hall (khall) <kyle>
Component: Self checkoutAssignee: Kyle M Hall (khall) <kyle>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: david, dcook
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 36586    
Bug Blocks:    
Attachments: Bug 40224: Replace use of location.href with POST logout form

Description Kyle M Hall (khall) 2025-06-24 11:26:55 UTC
The self-check module should use use POST for logouts instead of GET.
Comment 1 Kyle M Hall (khall) 2025-06-24 11:30:11 UTC
Created attachment 183443 [details] [review]
Bug 40224: Replace use of location.href with POST logout form

The self-check module should use use POST for logouts instead of GET.

Test Plan:
1) Enable WebBasedSelfCheck and SelfCheckInModule
2) Set SelfCheckTimeout and SelfCheckInTimeout to 10 seconds
3) Log in to each, observer the page is logged out after 10 seconds
   with not "op=logout" in the URL. Wait another 10 seconds, observe the
   page again refreshes with no "op=logout" in the URL.
Comment 2 David Nind 2025-06-24 19:54:02 UTC
Just checking if this is ready for sign off yet.
Comment 3 Kyle M Hall (khall) 2025-06-25 11:30:13 UTC
I'm concerned about issues with Bug 36586
Comment 4 David Cook 2025-07-10 00:00:17 UTC
Comment on attachment 183443 [details] [review]
Bug 40224: Replace use of location.href with POST logout form

Review of attachment 183443 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ +577,4 @@
>              // alert("checkout_confirm('" + patronid + "') called for barcode '" + barcode + "'");
>              if (! barcode) { dofocus(); return false; }    // no barcode
>              if (barcode == "__KOHA_NEW_CIRC__") {   // magic barcode
> +                $("#logout_post_form").submit();

Let's avoid jQuery

@@ +651,4 @@
>                      confirmModal("", _("Would you like to print a receipt?"), _("Print receipt and end session"), _("End session"), function(result) {
>                          if ( result && (Date.now() - confirmStart) < [% Koha.Preference('SelfCheckTimeout') | html %] ) {
>                              var win = window.open("/cgi-bin/koha/sco/printslip.pl?print=qslip");
> +                            $("#logout_post_form").submit();

Let's avoid jQuery

@@ +655,2 @@
>                          } else {
> +                            $("#logout_post_form").submit();

Let's avoid jQuery

@@ +657,4 @@
>                          }
>                      })
>                  [% ELSE %]
> +                    $("#logout_post_form").submit();

Let's avoid jQuery

::: koha-tmpl/opac-tmpl/bootstrap/js/timeout.js
@@ +31,4 @@
>      _timer_increment() {
>          this.idle_time++;
>          if (this.idle_time >= this.idle_timeout) {
> +            $("#" + this.form_id).submit();

Let's try to avoid jQuery. This is trivial to do with regular Javascript.
Comment 5 David Cook 2025-07-10 00:00:28 UTC
(In reply to Kyle M Hall (khall) from comment #0)
> The self-check module should use use POST for logouts instead of GET.

Makes sense!
Comment 6 David Cook 2025-07-10 00:52:23 UTC
(In reply to Kyle M Hall (khall) from comment #3)
> I'm concerned about issues with Bug 36586

Hopefully bug 40336 should fix those issues