Bug 18387 - 404 errors on page causes SCO user to be logged out
Summary: 404 errors on page causes SCO user to be logged out
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Target Milestone: ---
Assignee: Nick Clemens
QA Contact: Marcel de Rooy
URL:
Whiteboard:
Keywords:
Depends on: 22641
Blocks:
  Show dependency treegraph
 
Reported: 2017-04-05 12:15 UTC by Nick Clemens
Modified: 2019-04-30 12:27 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05


Attachments
Bug 18387: Allow sco-user to access errors templates (1.18 KB, patch)
2018-07-09 13:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 18387: Allow sco-user to access errors templates (1.23 KB, patch)
2019-04-04 15:10 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18387: (QA Follow up) adding specificity to error template. (1.00 KB, patch)
2019-04-04 15:13 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18387: (QA Follow up) adding specificity to error template. (927 bytes, patch)
2019-04-09 17:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18387: Allow sco-user to access errors templates (1.32 KB, patch)
2019-04-12 08:15 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 18387: (QA Follow up) adding specificity to error template. (1.00 KB, patch)
2019-04-12 08:15 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2017-04-05 12:15:25 UTC
If AutoSelfCheck is enabled but there is a 404 error in fetching resources on an SCO page the user is logged out on each request. This is because a 404 also requests the errorpages.tt which is outside the SCO module.

This causes a redirect to the opac-auth page when trying to print receipts after completing SCO transaction

To recreate:
1 - Enable AuthoSelfCheck prefs
2 - In opacuserjs or scouserjs add a fetch of an unreachable resources
3 - Visit the SCO
4 - Sign in as a patron then click 'finish'
5 - Say 'yes' to receipt
6 - Note you are directed to log in
Comment 1 Nick Clemens 2017-04-07 14:20:28 UTC
Looks like a 304 and others can trigger this as well
Comment 2 Eugene Espinoza 2017-04-09 01:47:40 UTC
Hi! We're experiencing this too in one of our Koha installation, 16.11.05.
Comment 3 Jonathan Druart 2017-04-11 20:10:34 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2017-04-11 20:10:52 UTC
I would not consider this as a bug, you just need to fix the url ...right?
Comment 5 Nick Clemens 2017-04-11 20:16:30 UTC
(In reply to Jonathan Druart from comment #4)
> I would not consider this as a bug, you just need to fix the url ...right?

Technically yes, but no visible error is thrown to the user, you are just silently signed out. Why fetch the 404 error template if we aren't displaying it?
Comment 6 Nick Clemens 2018-07-09 13:32:23 UTC
Created attachment 76797 [details] [review]
Bug 18387: Allow sco-user to access errors templates

To test:
 1 - Enable AuthoSelfCheck prefs
 2 - In opacuserjs or scouserjs add a fetch of an unreachable resources
 3 - Visit the SCO
 4 - Sign in as a patron then click 'finish'
 5 - Say 'yes' to receipt
 6 - Note you are directed to log in
 7 - Apply patch
 8 - Restart all the things
 9 - Repeat 4 & 5
10 - Sucess, receipt prints
Comment 7 Katrin Fischer 2018-07-11 05:47:55 UTC
Nick, please don't forget to set the assignee on your bugs!
Comment 8 Jonathan Druart 2018-10-17 20:53:05 UTC
It looks like we can be more precise and use the full path: errors/errorpage.tt
Comment 9 Liz Rea 2019-04-03 19:48:12 UTC
This definitely makes the slip show and be printable, but can someone else confirm this weird behaviour I'm seeing, where the SCO slip comes out as uninterpreted HTML instead of nicely formatted? Also the behaviour seems to manifest on master right now with or without an asset going 404. It's all very perplexing.
Comment 10 Liz Rea 2019-04-03 19:48:42 UTC
Should add that I was seeing this both with and without Jonathan's proposed modification.

Liz
Comment 11 Liz Rea 2019-04-04 15:10:43 UTC
Created attachment 87420 [details] [review]
Bug 18387: Allow sco-user to access errors templates

To test:
 1 - Enable AuthoSelfCheck prefs
 2 - In opacuserjs or scouserjs add a fetch of an unreachable resources
 3 - Visit the SCO
 4 - Sign in as a patron then click 'finish'
 5 - Say 'yes' to receipt
 6 - Note you are directed to log in
 7 - Apply patch
 8 - Restart all the things
 9 - Repeat 4 & 5
10 - Sucess, receipt prints

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 12 Liz Rea 2019-04-04 15:13:15 UTC
Created attachment 87421 [details] [review]
Bug 18387: (QA Follow up) adding specificity to error template.

Per Jonathan's comment.
Comment 13 Martin Renvoize 2019-04-08 11:27:37 UTC
Comment on attachment 87421 [details] [review]
Bug 18387: (QA Follow up) adding specificity to error template.

Review of attachment 87421 [details] [review]:
-----------------------------------------------------------------

::: C4/Auth.pm
@@ +192,5 @@
>          if (
>  # If the user logged in is the SCO user and they try to go out of the SCO module,
>  # log the user out removing the CGISESSID cookie
> +            $in->{template_name} !~ m|sco/| && $in->{template_name} !~ m|errors/errorpage.tt|
> +            &r C4::Context->preference('AutoSelfCheckID')

Looks like a typo here.. `&r` ?
Comment 14 Liz Rea 2019-04-09 17:49:49 UTC
Created attachment 87657 [details] [review]
Bug 18387: (QA Follow up) adding specificity to error template.

(sorry)
Comment 15 Martin Renvoize 2019-04-09 19:06:04 UTC
No worries, I initially thought it was a new perl operator I hadn't come across.

I'll do some testing proper tomorrow morning. Thanks Liz
Comment 16 Marcel de Rooy 2019-04-12 08:15:34 UTC
Created attachment 87845 [details] [review]
Bug 18387: Allow sco-user to access errors templates

To test:
 1 - Enable AuthoSelfCheck prefs
 2 - In opacuserjs or scouserjs add a fetch of an unreachable resources
 3 - Visit the SCO
 4 - Sign in as a patron then click 'finish'
 5 - Say 'yes' to receipt
 6 - Note you are directed to log in
 7 - Apply patch
 8 - Restart all the things
 9 - Repeat 4 & 5
10 - Sucess, receipt prints

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 17 Marcel de Rooy 2019-04-12 08:15:39 UTC
Created attachment 87846 [details] [review]
Bug 18387: (QA Follow up) adding specificity to error template.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 18 Nick Clemens 2019-04-12 11:48:51 UTC
Awesome work all!

Pushed to master for 19.05
Comment 19 Martin Renvoize 2019-04-16 13:17:47 UTC
Pushed to 18.11.x for 18.11.05
Comment 20 Lucas Gass 2019-04-22 21:55:29 UTC
18.05.x is currently missing 22641 dependency, im not backporting this to 18.05.x series