Bug 22542 - Back browser should not allow to see other patrons details (see bug 5371)
Summary: Back browser should not allow to see other patrons details (see bug 5371)
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 23467
  Show dependency treegraph
 
Reported: 2019-03-20 02:36 UTC by Katrin Fischer
Modified: 2019-11-06 10:02 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05, 18.05.12, 17.11.18


Attachments
Bug 22542: Force back button to display personal data (10.02 KB, patch)
2019-03-21 17:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 22542: Force back button to display personal data (10.07 KB, patch)
2019-04-12 13:26 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 22542: Force back button to display personal data (10.13 KB, patch)
2019-04-15 00:56 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2019-03-20 02:36:30 UTC
With bug 5371 we fixed OPAC pages to not show a former patron's details when using the back button in the browser.

I noticed that not all pages are using force_no_caching => 1 now, notably opac-illrequests.pl doesn't appear to use it, some others like opac-suggestions neither. 

I think we should check if that is ok or if we need to fix files again. Can't confirm right now if it works ok all over.
Comment 1 Jonathan Druart 2019-03-21 17:54:37 UTC
Created attachment 86858 [details] [review]
Bug 22542: Force back button to display personal data

This is a follow-up of bug 5371

The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching

This must be a test somehwere to prevent further regressions.
Comment 2 Katrin Fischer 2019-04-12 13:26:32 UTC
Created attachment 87907 [details] [review]
Bug 22542: Force back button to display personal data

This is a follow-up of bug 5371

The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching

This must be a test somehwere to prevent further regressions.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Katrin Fischer 2019-04-12 13:27:31 UTC
Should we make the same change for other pages as well?

Thinking of, but not sure, as those pages don't require login necessarily:

opac-password-recovery
opac-registration-verify
opac-suggestions
Comment 4 Chris Cormack 2019-04-15 00:56:25 UTC
Created attachment 87974 [details] [review]
Bug 22542: Force back button to display personal data

This is a follow-up of bug 5371

The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching

This must be a test somehwere to prevent further regressions.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 5 Martin Renvoize 2019-04-26 16:29:43 UTC
Pushed to 18.11.x for 18.11.05
Comment 6 Fridolin SOMERS 2019-04-30 06:15:27 UTC
Pushed to 18.05.x for 18.05.12

Pushed to 17.11.x for 17.11.18
Comment 7 Nick Clemens 2019-05-02 13:53:06 UTC
Awesome work all!

Pushed to master for 19.05