Bug 23874 - Advanced Editor is not loaded if X-Content-Type-Options: nosniff
Summary: Advanced Editor is not loaded if X-Content-Type-Options: nosniff
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: Main
Hardware: All All
: P4 minor
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-10-22 13:51 UTC by Tomáš Wünsch
Modified: 2020-07-13 18:26 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
printscreen of security failure (39.98 KB, image/png)
2019-10-22 14:00 UTC, Tomáš Wünsch
Details
printscreen from console - http needed on https connection (20.66 KB, image/png)
2019-10-22 14:01 UTC, Tomáš Wünsch
Details
Bug 23874: Fix advanced editor if nosniff is set (1.15 KB, patch)
2019-11-11 17:38 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomáš Wünsch 2019-10-22 13:51:36 UTC
Symptoms:
Loading, please wait...
Editor of record is visually loaded in background, but over it is big endless running circle with announcement: "Loading, please wait...

Source of problem:
The script is by default blocked by browsers because there is some hardlink to HTTP content.

Another details:
- This is related both to 18.05 and 19.05, Firefox and Chrome, Win10 and Ubuntu, and it's behaving practically same.
- We have in general disabled (forwarded) all unsecured traffic to https at our nginx rproxy server.


Console output:

Blocked loading mixed active content 
“http://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?callback=define”
editor.pl
The resource from 
“https://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define” was blocked due to MIME type (“text/html”) mismatch (X-Content-Type-Options: nosniff).
editor.pl
<script> source URI is not allowed in this document: 
“https://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define”. editor.pl:1:1
Error: Script error for: /cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define
http://requirejs.org/docs/errors.html#scripterror
Comment 1 Tomáš Wünsch 2019-10-22 14:00:08 UTC
Created attachment 94565 [details]
printscreen of security failure
Comment 2 Tomáš Wünsch 2019-10-22 14:01:04 UTC
Created attachment 94578 [details]
printscreen from console - http needed on https connection
Comment 3 Tomáš Wünsch 2019-10-22 14:43:46 UTC
temporary solution:
- about:config in FF
- security.mixed_content.block_active_content setup to "false".
Comment 4 Katrin Fischer 2019-11-02 22:06:36 UTC
I can't replicate this issue on 18.11.10 - any more clues on where the hardcoded bit is hiding?
Comment 5 Tomáš Wünsch 2019-11-06 11:58:58 UTC
Not sure how to help. You can login into our 19.05:
https://demo.koha.cz/ 
user   demo
passwd demo
Comment 6 Katrin Fischer 2019-11-06 13:00:39 UTC
(In reply to Tomáš Wünsch from comment #5)
> Not sure how to help. You can login into our 19.05:
> https://demo.koha.cz/ 
> user   demo
> passwd demo

Hi Tomas, the Advanced Editor appears to be turned off on that one and I don't have access to the system preferences with that login.
Comment 7 Katrin Fischer 2019-11-06 13:45:52 UTC
(In reply to Katrin Fischer from comment #6)
> (In reply to Tomáš Wünsch from comment #5)
> > Not sure how to help. You can login into our 19.05:
> > https://demo.koha.cz/ 
> > user   demo
> > passwd demo
> 
> Hi Tomas, the Advanced Editor appears to be turned off on that one and I
> don't have access to the system preferences with that login.

I've tested in the Catalyst demo that uses https, but the Advanced editor loads:
https://demo-intra.mykoha.co.nz/cgi-bin/koha/cataloguing/editor.pl#new/
(https://koha-community.org/demo/)

Tested in Firefox on Ubuntu. Did I miss something form the test plan?
Comment 8 Jonathan Druart 2019-11-11 17:38:17 UTC
Created attachment 95274 [details] [review]
Bug 23874: Fix advanced editor if nosniff is set
Comment 9 Jonathan Druart 2019-11-11 17:39:14 UTC
Hi Tomáš, can you try this patch please?

I am pretty sure we will need to adjust much more occurrences.
Comment 10 Marcel de Rooy 2019-11-12 13:21:04 UTC
(In reply to Jonathan Druart from comment #8)
> Created attachment 95274 [details] [review] [review]
> Bug 23874: Fix advanced editor if nosniff is set

Hi Jonathan,
I am curious why this makes a difference?
The fact that you ask to return JSON does not make it a different GET request?

Marcel


Just for reference:
jQuery.get( url [, data ] [, success ] [, dataType ] )
Comment 11 Jonathan Druart 2019-11-12 14:24:44 UTC
Hum I think my tests were wrong yesterday. I thought I saw a content type text/html before this patch, then json. But I cannot replicate this.