Bug 36586 - Self-checkouts will get CSRF errors if left inactive for 8 hours
Summary: Self-checkouts will get CSRF errors if left inactive for 8 hours
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Nick Clemens (kidclamp)
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords: release-notes-needed
Depends on:
Blocks: 40224 40158
  Show dependency treegraph
 
Reported: 2024-04-12 04:37 UTC by David Cook
Modified: 2025-06-24 12:09 UTC (History)
11 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00,24.11.05
Circulation function:


Attachments
Bug 36586: WIP (2.90 KB, patch)
2024-12-04 21:14 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36586: WIP (3.85 KB, patch)
2024-12-05 12:34 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36586: Define self-checkin timer using Javascript class (4.11 KB, patch)
2024-12-24 00:07 UTC, David Cook
Details | Diff | Splinter Review
Bug 36586: Define self-checkin timer using Javascript class (28.36 KB, patch)
2025-04-29 11:26 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36586: Add sc-timer to sco (6.63 KB, patch)
2025-04-29 11:26 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36586: Define self-checkin timer using Javascript class (28.40 KB, patch)
2025-04-30 04:09 UTC, David Nind
Details | Diff | Splinter Review
Bug 36586: Add sc-timer to sco (6.67 KB, patch)
2025-04-30 04:09 UTC, David Nind
Details | Diff | Splinter Review
Bug 36586: Define self-checkin timer using Javascript class (28.47 KB, patch)
2025-05-02 15:31 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 36586: Add sc-timer to sco (6.74 KB, patch)
2025-05-02 15:31 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 36586: Fix tidy (25.57 KB, patch)
2025-05-07 13:07 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36586: Define self-checkin timer using Javascript class (12.73 KB, patch)
2025-05-07 13:09 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-04-12 04:37:29 UTC
Currently, the CSRF token is only good for 8 hours. This means that a self-checkout terminal left inactive for 8 hours (e.g. overnight, over a holiday closure, etc) will create a wrong CSRF token error on the first activity attempt in the morning.
Comment 1 David Cook 2024-04-12 04:44:52 UTC
I think the most obvious (but not necessarily the best) solution is to have a timer that refreshes the main SCO page at certain intervals. 

--

(Note that this same problem will probably arise with Vue.js driven pages.)
Comment 2 Jonathan Druart 2024-11-06 14:58:07 UTC
SCI has a SelfCheckInTimeout pref that refreshes the screen.
Comment 3 David Cook 2024-11-06 22:10:57 UTC
(In reply to Jonathan Druart from comment #2)
> SCI has a SelfCheckInTimeout pref that refreshes the screen.

That should do the trick. We could move that out to a .js file and use it in both interfaces.
Comment 4 Nick Clemens (kidclamp) 2024-12-04 21:14:08 UTC
Created attachment 175210 [details] [review]
Bug 36586: WIP

This patch moves the refresh code into a js include and sets a few variables in the page.
It also moves the fetch of the pref into the template.

We need to copy this over for the sco - and probably add a new pref.

Lastly, the code here only refreshes during an active session, probably we could have a single pref
SelfCheckRefresh
that would trigger on the main page, default to 3 or 4 hours?
Comment 5 David Cook 2024-12-04 23:12:38 UTC
(In reply to Nick Clemens (kidclamp) from comment #4)
> This patch moves the refresh code into a js include and sets a few variables
> in the page.

Did you write the JS file? It's not appearing in the patch.

> Lastly, the code here only refreshes during an active session, probably we
> could have a single pref
> SelfCheckRefresh
> that would trigger on the main page, default to 3 or 4 hours?

As in, the current timeout is just an activity timeout to log them out? 

Yeah, I think a timer on the main page that defaults to even 1 time per hour would be good.
Comment 6 Nick Clemens (kidclamp) 2024-12-05 12:34:11 UTC
Created attachment 175239 [details] [review]
Bug 36586: WIP

This patch moves the refresh code into a js include and sets a few variables in the page.
It also moves the fetch of the pref into the template.

We need to copy this over for the sco - and probably add a new pref.

Lastly, the code here only refreshes during an active session, probably we could have a single pref
SelfCheckRefresh
that would trigger on the main page, default to 3 or 4 hours?
Comment 7 Nick Clemens (kidclamp) 2024-12-05 12:35:24 UTC
(In reply to David Cook from comment #5)
> (In reply to Nick Clemens (kidclamp) from comment #4) 
> Did you write the JS file? It's not appearing in the patch.

heh, "git commit -a", but didn't add the new file ;-)
Comment 8 David Cook 2024-12-06 00:44:35 UTC
Comment on attachment 175239 [details] [review]
Bug 36586: WIP

Review of attachment 175239 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
@@ +274,4 @@
>  });
>  
>  
> +        let idleTimeout = [% Koha.Preference('SelfCheckInTimeOut') || 120 %];

There's a filter missing here. I noticed with the eyeballs and QA tools says it as well.
Comment 9 David Cook 2024-12-06 00:54:49 UTC
(In reply to Nick Clemens (kidclamp) from comment #7)
> heh, "git commit -a", but didn't add the new file ;-)

I've been writing a lot of new code on a different project, and I feel this pain haha
Comment 10 David Cook 2024-12-06 01:07:08 UTC
This WIP looks like it works for the existing functionality. 

But since we want timers for the borrower session and the SCO/SCI session, I'm thinking we should encapsulate the timers in objects. We'd create 2 objects, and then feed them their respective timer thresholds.
Comment 11 Nick Clemens (kidclamp) 2024-12-23 17:28:44 UTC
(In reply to David Cook from comment #10)
> This WIP looks like it works for the existing functionality. 
> 
> But since we want timers for the borrower session and the SCO/SCI session,
> I'm thinking we should encapsulate the timers in objects. We'd create 2
> objects, and then feed them their respective timer thresholds.

I don't think I am quite sure what you mean here, JS objects? Koha Objects? Can you help with a patch or some pseudo code?
Comment 12 David Cook 2024-12-23 22:55:00 UTC
(In reply to Nick Clemens (kidclamp) from comment #11)
> (In reply to David Cook from comment #10)
> > This WIP looks like it works for the existing functionality. 
> > 
> > But since we want timers for the borrower session and the SCO/SCI session,
> > I'm thinking we should encapsulate the timers in objects. We'd create 2
> > objects, and then feed them their respective timer thresholds.
> 
> I don't think I am quite sure what you mean here, JS objects? Koha Objects?
> Can you help with a patch or some pseudo code?

Ah my bad. Yeah, JS objects. 

Sure, I'll look at doing a quick patch.
Comment 13 David Cook 2024-12-24 00:07:37 UTC
Created attachment 175919 [details] [review]
Bug 36586: Define self-checkin timer using Javascript class

This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).
Comment 14 David Cook 2024-12-24 00:12:06 UTC
So the Javascript class here allows us to create multiple objects with the same code, so we can have the "window.sci_login_timer" which just governs the login timeout.

But then we could easily create another timer for however many hours we want. (For that scenario, perhaps we'd actually want to set a higher interval than 1 second, and instead maybe check every minute or X minutes. 

Anyway, that's what I had in mind. 

I wrote it without jQuery, and I tweaked the conditions a bit, so that we're only invoking the timer where we need it in the first place rather than running it and checking for the button visibility on each increment.

--

Also added in the missing TT filter and wrapper the idleTimeout in double quotes to avoid XSS.
Comment 15 Lucas Gass (lukeg) 2025-04-22 21:15:28 UTC
Hey David, is this ready for testing?
Comment 16 David Cook 2025-04-22 23:57:06 UTC
(In reply to Lucas Gass (lukeg) from comment #15)
> Hey David, is this ready for testing?

Mmm... I think it could be tested, but really someone (myself or someone else) needs to add it for the SCO too. 

The "login_timeout" function could actually get moved to timeout.js too.

At the moment, I'm just making an exception to CSRF for self-checks, so this hasn't been a priority for me. 

And actually... looking at this again... I think we've just refactored what's already there? I think this just redirects to the sci-main.pl after an inactivity timeout under some conditions. I don't think it would prevent the CSRF issue...

So yeah... no not ready for testing, alas.
Comment 17 Nick Clemens (kidclamp) 2025-04-29 11:26:51 UTC
Created attachment 181645 [details] [review]
Bug 36586: Define self-checkin timer using Javascript class

This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).

To test:
1 - Set SelfCheckinTimeout to a small value like 5
2 - Go to the self checkin:
    http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3 - Sign in as the SCI user
4 - Watch the page, it should refresh every 5 seconds
5 - Confirm that moving the mouse/typing prevents the reset
6 - Check in an item
7 - Wait and confirm reload of main page happens when idle
8 - Confirm mouse/typing prevents refresh
9 - Sign off!
Comment 18 Nick Clemens (kidclamp) 2025-04-29 11:26:53 UTC
Created attachment 181646 [details] [review]
Bug 36586: Add sc-timer to sco

This patch implements the timer form the last patch on the sco

To test:
1 - Set SelfCheckTimout to 5 or something low for testing
2 - Go to the self checkout module
3 - Either sign in or confirm you have AutoSelfCheck user setup
4 - Observe the page reloads every 5 seocnds (or as you set above)
5 - Sign in as a patron
6 - Confirm on idle you are logged out to home page
7 - Sign off!
Comment 19 David Nind 2025-04-30 04:09:35 UTC
Created attachment 181694 [details] [review]
Bug 36586: Define self-checkin timer using Javascript class

This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).

To test:
1 - Set SelfCheckinTimeout to a small value like 5
2 - Go to the self checkin:
    http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3 - Sign in as the SCI user
4 - Watch the page, it should refresh every 5 seconds
5 - Confirm that moving the mouse/typing prevents the reset
6 - Check in an item
7 - Wait and confirm reload of main page happens when idle
8 - Confirm mouse/typing prevents refresh
9 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Comment 20 David Nind 2025-04-30 04:09:38 UTC
Created attachment 181695 [details] [review]
Bug 36586: Add sc-timer to sco

This patch implements the timer form the last patch on the sco

To test:
1 - Set SelfCheckTimout to 5 or something low for testing
2 - Go to the self checkout module
3 - Either sign in or confirm you have AutoSelfCheck user setup
4 - Observe the page reloads every 5 seocnds (or as you set above)
5 - Sign in as a patron
6 - Confirm on idle you are logged out to home page
7 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Comment 21 David Nind 2025-04-30 04:20:08 UTC
The thing I most noticed after the patches is that:
1. The self check-in page visible refreshes every 5 seconds.
2. The self check-out login page visible refreshes every 5 seconds.

Before the patches, this did not happen.

Testing notes (using KTD)
========================

Self check-in
-------------

Self check-in (not enabled by default in KTD):
0. Enable the SelfCheckInModule system preference
1. Set SelfCheckinTimeout system preference to 5
2. http://127.0.0.1:8080/cgi-bin/koha/sci/sci-main.pl
3. Log in as the koha user (the password is koha)

Before the patch: 
- you are logged out after 5 seconds
- the self check-in page doesn't auto-refresh

After the patch:
- you are logged out after 5 seconds
- self check-in page refreshes every 5 seconds (or the refresh is not visible)
- the page doesn't refresh if you are typing in a barcode slowly

Self check-out
--------------

Self check-out (enabled by default in KTD):
1. Set SelfCheckTimout system preference to 5
2. URL: 127.0.0.1:8080/cgi-bin/koha/sco/sco-main.pl
3. Log in as the koha user (the password is koha)

Before the patch:
- you are logged out after 5 seconds
- the self check-in page doesn't auto-refresh (or the refresh is not visible)
- if you are logged in and have started typing in a barcode slowly, it logs you out - even if you haven't finished typing in a barcode

After the patch:
- you are logged out after 5 seconds, unless you interrupt it
- the login page continues to refresh every 5 seconds
- if you are logged in and have started typing in a barcode slowly, it no longer  logs you out (it does if you don't enter anything after 5 seconds)
Comment 22 Nick Clemens (kidclamp) 2025-05-01 13:30:50 UTC
(In reply to David Nind from comment #21)
> The thing I most noticed after the patches is that:
> 1. The self check-in page visible refreshes every 5 seconds.
> 2. The self check-out login page visible refreshes every 5 seconds.
> 
> Before the patches, this did not happen.
> 
Excellent! That is exactly what we want - a hard refresh to ensure the CSRF token is valid and that user info doesn't remain too long.

5 seconds is probably an extreme case, but the default of 2 minutes seems reasonable for this
Comment 23 David Cook 2025-05-02 02:18:35 UTC
Hey Nick, I just noticed you took over my authorship for that first patch haha. Fair enough though. Looks like it need some squashing down. 

I reckon that means I can probably QA this one too.
Comment 24 Martin Renvoize (ashimema) 2025-05-02 15:31:33 UTC
Created attachment 181874 [details] [review]
Bug 36586: Define self-checkin timer using Javascript class

This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).

To test:
1 - Set SelfCheckinTimeout to a small value like 5
2 - Go to the self checkin:
    http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3 - Sign in as the SCI user
4 - Watch the page, it should refresh every 5 seconds
5 - Confirm that moving the mouse/typing prevents the reset
6 - Check in an item
7 - Wait and confirm reload of main page happens when idle
8 - Confirm mouse/typing prevents refresh
9 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 25 Martin Renvoize (ashimema) 2025-05-02 15:31:36 UTC
Created attachment 181875 [details] [review]
Bug 36586: Add sc-timer to sco

This patch implements the timer form the last patch on the sco

To test:
1 - Set SelfCheckTimout to 5 or something low for testing
2 - Go to the self checkout module
3 - Either sign in or confirm you have AutoSelfCheck user setup
4 - Observe the page reloads every 5 seocnds (or as you set above)
5 - Sign in as a patron
6 - Confirm on idle you are logged out to home page
7 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 26 Martin Renvoize (ashimema) 2025-05-02 15:32:09 UTC
Nice clear fix. Passing QA
Comment 27 Katrin Fischer 2025-05-06 16:07:49 UTC
Hm, I don't quite understand how these happen?

 FAIL	koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
   FAIL	  tidiness
		File is not tidy, please run `perl misc/devel/tidy.pl koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt`
Comment 28 Katrin Fischer 2025-05-06 16:09:31 UTC
Tidy fails: 

kohadev-koha@kohadevbox:koha(main)$ perl misc/devel/tidy.pl koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
Tidying file 1/1 (koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt)
[error] Sz8kRHIZ6p.tt: SyntaxError: CssSyntaxError: Unknown word (1:1)
[error] > 1 | [% Koha.Preference('OPACUserCSS') | $raw %]
[error]     | ^ at misc/devel/tidy.pl line 112.

Some files cannot be tidied:
	* koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
[error] Sz8kRHIZ6p.tt: SyntaxError: CssSyntaxError: Unknown word (1:1)
[error] > 1 | [% Koha.Preference('OPACUserCSS') | $raw %]
[error]     | ^

Looks like a false positive, but can you please double check?
Comment 29 Jonathan Druart 2025-05-07 13:07:15 UTC
Created attachment 182022 [details] [review]
Bug 36586: Fix tidy
Comment 30 Jonathan Druart 2025-05-07 13:07:54 UTC
QA script AND pre-commit hook must have caught that.
Comment 31 Jonathan Druart 2025-05-07 13:09:41 UTC
Created attachment 182023 [details] [review]
Bug 36586: Define self-checkin timer using Javascript class

This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).

To test:
1 - Set SelfCheckinTimeout to a small value like 5
2 - Go to the self checkin:
    http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3 - Sign in as the SCI user
4 - Watch the page, it should refresh every 5 seconds
5 - Confirm that moving the mouse/typing prevents the reset
6 - Check in an item
7 - Wait and confirm reload of main page happens when idle
8 - Confirm mouse/typing prevents refresh
9 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

Bug 36586: Add sc-timer to sco

This patch implements the timer form the last patch on the sco

To test:
1 - Set SelfCheckTimout to 5 or something low for testing
2 - Go to the self checkout module
3 - Either sign in or confirm you have AutoSelfCheck user setup
4 - Observe the page reloads every 5 seocnds (or as you set above)
5 - Sign in as a patron
6 - Confirm on idle you are logged out to home page
7 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

Bug 36586: Fix tidy
Comment 32 Jonathan Druart 2025-05-07 13:10:04 UTC
We need to squash here.
Comment 33 Katrin Fischer 2025-05-08 06:01:10 UTC
Pushed for 25.05!

Well done everyone, thank you!
Comment 34 Kristi 2025-05-13 17:22:02 UTC
We are excited to see this for 25.05! Could this be backported to 24.11?
Comment 35 Emmi Takkinen 2025-05-21 05:47:34 UTC
I'm little late on this, but to me it seems that timeout doesn't currently work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just after few seconds. Changing greater value to SelfCheckInTimeout doesn't help.  Also reloading the page takes sometimes a long time which can lead to situation where patron might try to log in while loading is still processed and their login credentials are swiped out after loading is finished.
Comment 36 David Cook 2025-05-21 23:34:35 UTC
(In reply to Emmi Takkinen from comment #35)
> I'm little late on this, but to me it seems that timeout doesn't currently
> work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just
> after few seconds. Changing greater value to SelfCheckInTimeout doesn't
> help.  Also reloading the page takes sometimes a long time which can lead to
> situation where patron might try to log in while loading is still processed
> and their login credentials are swiped out after loading is finished.

I'll take a quick look to see if I can reproduce.
Comment 37 David Cook 2025-05-21 23:46:07 UTC
(In reply to Emmi Takkinen from comment #35)
> I'm little late on this, but to me it seems that timeout doesn't currently
> work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just
> after few seconds. Changing greater value to SelfCheckInTimeout doesn't
> help.  Also reloading the page takes sometimes a long time which can lead to
> situation where patron might try to log in while loading is still processed
> and their login credentials are swiped out after loading is finished.

So you mention SelfCheckInTimeout and SCO in the same sentence, but the former belongs to the SCI feature and the latter is the SCO feature. They're two different things. 

SelfCheckTimeout is used for:
http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
This is working correctly for me. It's taking the configured amount of time (e.g. 120 or 118 if I set that in SelfCheckTimeout)

SelfCheckInTimeout is used for:
http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
This is working correctly for me too. It's taking the configured amount of time (e.g. 120 or 111 as I set in SelfCheckInTimeout)

--

The reload should also be very fast. If it's slow for you, it might be due to your server being very busy.

Very weird that the SCO reloads just after few seconds. Sounds like you've got other problems with your Koha that you'll need to troubleshoot. 

Or maybe I'm not following the exact same steps as you and it works in many scenarios but not all?

You can check the timer via the browser console using the following on the appropriate interface:
console.log(window.sco_login_timer);
console.log(window.sci_login_timer);

That will show you the timeout threshold and the current idle time.
Comment 38 Emmi Takkinen 2025-05-23 10:32:40 UTC
(In reply to David Cook from comment #37)
> (In reply to Emmi Takkinen from comment #35)
> > I'm little late on this, but to me it seems that timeout doesn't currently
> > work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just
> > after few seconds. Changing greater value to SelfCheckInTimeout doesn't
> > help.  Also reloading the page takes sometimes a long time which can lead to
> > situation where patron might try to log in while loading is still processed
> > and their login credentials are swiped out after loading is finished.
> 
> So you mention SelfCheckInTimeout and SCO in the same sentence, but the
> former belongs to the SCI feature and the latter is the SCO feature. They're
> two different things. 
> 
> SelfCheckTimeout is used for:
> http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
> This is working correctly for me. It's taking the configured amount of time
> (e.g. 120 or 118 if I set that in SelfCheckTimeout)
> 
> SelfCheckInTimeout is used for:
> http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
> This is working correctly for me too. It's taking the configured amount of
> time (e.g. 120 or 111 as I set in SelfCheckInTimeout)
> 
> --
Loading does work correctly, I just mixed up those two sysprefs with each other. So no problem there, sorry for that.

> 
> The reload should also be very fast. If it's slow for you, it might be due
> to your server being very busy.
> 
> Very weird that the SCO reloads just after few seconds. Sounds like you've
> got other problems with your Koha that you'll need to troubleshoot. 
> 
> Or maybe I'm not following the exact same steps as you and it works in many
> scenarios but not all?
> 
> You can check the timer via the browser console using the following on the
> appropriate interface:
> console.log(window.sco_login_timer);
> console.log(window.sci_login_timer);
> 
> That will show you the timeout threshold and the current idle time.

I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again.  But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
Comment 39 Paul Derscheid 2025-05-26 18:17:47 UTC
Nice work everyone!

Pushed to 24.11.x for 24.11.05
Comment 40 Christopher Brannon 2025-06-17 22:02:36 UTC
This patch may have broken the print slip function in SCO.
Comment 41 Kyle M Hall (khall) 2025-06-24 12:09:19 UTC
> I took a look at this again and actually loading isn't slow, page is just
> loaded again and again after first reload is done (seems to happen from 2 to
> up to 80 times). Then loading stops, page reloads again after 10 seconds (as
> set in syspref) and frequent loading starts again.  But this only happens on
> my installation, not in sandboxes for example. No idea where this could come
> from but I'll provide a new bug report if it's Koha related problem.

We've had reports of the same. We've had partners in production have their servers become unusable because the self-checks are sending 50 logout requests a second.