Bug 14743 - addorder.pl redirect problems under plack behind apache 2.4.10
Summary: addorder.pl redirect problems under plack behind apache 2.4.10
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Assignee: Kyle M Hall
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on: 12648
Blocks: 13791
  Show dependency treegraph
 
Reported: 2015-08-27 14:00 UTC by Dobrica Pavlinusic
Modified: 2017-06-14 22:10 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 14743 - addorder.pl redirect problems under plack behind apache 2.4.10 (2.53 KB, patch)
2015-11-05 13:27 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 14743 - addorder.pl redirect problems under plack behind apache 2.4.10 (2.58 KB, patch)
2015-11-06 19:56 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 14743 - addorder.pl redirect problems under plack behind apache 2.4.10 (2.65 KB, patch)
2015-11-10 12:01 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Dobrica Pavlinusic 2015-08-27 14:00:03 UTC
I can't quite figure this out. When I run CGI version of Koha, I see following response (recorded using tcpdump):

HTTP/1.1 302 Found
Date: Thu, 27 Aug 2015 13:28:41 GMT
Server: Apache/2.4.10 (Debian)
Location: /cgi-bin/koha/acqui/basket.pl?basketno=5610
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/x-perl

However, when running behind apache 2.4.10 on Debian wheezy I see chunked response:

HTTP/1.1 302 Found
Date: Thu, 27 Aug 2015 13:21:28 GMT
Server: Apache/2.4.10 (Debian)
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/x-perl

60
Transfer-Encoding: chunked
Date: Thu, 27 Aug 2015 13:21:28 GMT
Connection: keep-alive

0


0

This response doesn't work in firefox (where it reports page not found) nor in chrome (where it returns lines below 60 on screen).

Solution is (for now) to exclude addoprder.pl from proxypass using:

ProxyPass /cgi-bin/koha/acqui/addorder.pl !
Comment 1 Kyle M Hall 2015-11-05 13:23:58 UTC
In the template the hidden input 'basketno' is listed twice. What the cgi script reads in the parameter, what is does is concat the values of the multiple basketno instances together createing what is likely an invalid basketno. For reasons beyond my understanding this is what triggers this error!
Comment 2 Kyle M Hall 2015-11-05 13:27:12 UTC Comment hidden (obsolete)
Comment 3 Josef Moravec 2015-11-06 19:56:03 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-11-10 12:01:45 UTC
Created attachment 44689 [details] [review]
Bug 14743 - addorder.pl redirect problems under plack behind apache 2.4.10

I can't quite figure this out. When I run CGI version of Koha, I see following response (recorded using tcpdump):

HTTP/1.1 302 Found
Date: Thu, 27 Aug 2015 13:28:41 GMT
Server: Apache/2.4.10 (Debian)
Location: /cgi-bin/koha/acqui/basket.pl?basketno=5610
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/x-perl

However, when running behind apache 2.4.10 on Debian wheezy I see chunked response:

HTTP/1.1 302 Found
Date: Thu, 27 Aug 2015 13:21:28 GMT
Server: Apache/2.4.10 (Debian)
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/x-perl

60
Transfer-Encoding: chunked
Date: Thu, 27 Aug 2015 13:21:28 GMT
Connection: keep-alive

0

0

This response doesn't work in firefox (where it reports page not found) nor in chrome (where it returns lines below 60 on screen).

In the template the hidden input 'basketno' is listed twice. What the cgi script reads in the parameter, what is does is concat the values of the multiple basketno instances together createing what is likely an invalid basketno. For reasons beyond my understanding this is what triggers this error!

Test Plan:
1) Using plack, add an order to a basket from an external source
2) Note the error
3) Apply this patch
4) Add an order to a basket from an external source
5) Note you get no error!

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Jonathan Druart 2015-11-10 12:02:18 UTC
Nice catch Kyle!
We absolutely need to keep that in mind!
Comment 6 Jonathan Druart 2015-11-10 12:04:28 UTC
The duplication has been introduced by bug 12648 (sorry about that!).
Comment 7 Tomás Cohen Arazi 2015-11-10 12:49:55 UTC
Patch pushed to master.

Thanks Kyle!
Comment 8 Frédéric Demians 2015-11-29 20:47:03 UTC
This patch has been pushed to 3.20.x, will be in 3.20.6.