Bug 22585 - Fix remaining double-escaped CAS links
Summary: Fix remaining double-escaped CAS links
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Justin Rittenhouse
QA Contact: Testopia
URL:
Keywords:
: 23026 (view as bug list)
Depends on: 21973
Blocks:
  Show dependency treegraph
 
Reported: 2019-03-26 20:56 UTC by Justin Rittenhouse
Modified: 2019-06-26 14:50 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.01


Attachments
remove double-escape for CAS URL (938 bytes, patch)
2019-03-26 20:56 UTC, Justin Rittenhouse
Details | Diff | Splinter Review
Bug 22585: remove double-escape for CAS URL (1.55 KB, patch)
2019-06-06 14:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 22585: (follow-up) Fix additional occurences (1.88 KB, patch)
2019-06-10 13:42 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 22585: remove double-escape for CAS URL (1.60 KB, patch)
2019-06-13 06:10 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 22585: (follow-up) Fix additional occurences (1.94 KB, patch)
2019-06-13 06:11 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Justin Rittenhouse 2019-03-26 20:56:44 UTC
Created attachment 87036 [details] [review]
remove double-escape for CAS URL

The return URL that is part of the link to CAS login is double-escaped on the staff login page.  This means that %3A%2F%2F is converted to %253A%252F%252F.

It appears that this is the same issue as bug 21973 but in the staff intranet template.  I have attached an identical patch for the intranet auth.tt file.
Comment 1 Jonathan Druart 2019-05-31 17:51:56 UTC
*** Bug 23026 has been marked as a duplicate of this bug. ***
Comment 2 Nick Clemens 2019-06-06 14:32:59 UTC
Created attachment 90376 [details] [review]
Bug 22585: remove double-escape for CAS URL

The return URL that is part of the link to CAS login is double-escaped on the staff login page.

It appears that this is the same issue as bug 21973 but in the staff intranet template.  I have attached an identical patch for the intranet auth.tt file.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 3 Katrin Fischer 2019-06-09 21:12:10 UTC
With this patch, there remains:

koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt:                                            <li><a href="[% casServer.value | url %]">

Can you please check if this needs to be changed as well?
Comment 4 Jonathan Druart 2019-06-10 13:31:19 UTC
It comes from:

C4/Auth.pm

1310             foreach my $key ( keys %$casservers ) {
1311                 push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
1312             }

So you are right Katrin, it must not be filtered.
Comment 5 Nick Clemens 2019-06-10 13:42:36 UTC
Created attachment 90456 [details] [review]
Bug 22585: (follow-up) Fix additional occurences
Comment 6 Jonathan Druart 2019-06-10 14:29:15 UTC
This patch is for OPAC and so more a follow-up for bug 21973. But I am not sure it would make sense to open a third report for it.
Comment 7 Nick Clemens 2019-06-10 14:44:27 UTC
(In reply to Jonathan Druart from comment #6)
> This patch is for OPAC and so more a follow-up for bug 21973. But I am not
> sure it would make sense to open a third report for it.

Maybe just retitle this one as "Fix remaning CAS links"?
Comment 8 Katrin Fischer 2019-06-13 06:10:57 UTC
Created attachment 90554 [details] [review]
Bug 22585: remove double-escape for CAS URL

The return URL that is part of the link to CAS login is double-escaped on the staff login page.

It appears that this is the same issue as bug 21973 but in the staff intranet template.  I have attached an identical patch for the intranet auth.tt file.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Katrin Fischer 2019-06-13 06:11:00 UTC
Created attachment 90555 [details] [review]
Bug 22585: (follow-up) Fix additional occurences

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 10 Martin Renvoize 2019-06-13 11:07:42 UTC
Nice work!

Pushed to master for 19.11.00
Comment 11 Fridolin SOMERS 2019-06-17 07:59:54 UTC
Pushed to 19.05.x for 19.05.01
Comment 12 Lucas Gass 2019-06-26 14:50:02 UTC
backported to 18.11.x for 18.11.07