Currently, the CSRF token is only good for 8 hours. This means that a self-checkout terminal left inactive for 8 hours (e.g. overnight, over a holiday closure, etc) will create a wrong CSRF token error on the first activity attempt in the morning.
I think the most obvious (but not necessarily the best) solution is to have a timer that refreshes the main SCO page at certain intervals. -- (Note that this same problem will probably arise with Vue.js driven pages.)
SCI has a SelfCheckInTimeout pref that refreshes the screen.
(In reply to Jonathan Druart from comment #2) > SCI has a SelfCheckInTimeout pref that refreshes the screen. That should do the trick. We could move that out to a .js file and use it in both interfaces.
Created attachment 175210 [details] [review] Bug 36586: WIP This patch moves the refresh code into a js include and sets a few variables in the page. It also moves the fetch of the pref into the template. We need to copy this over for the sco - and probably add a new pref. Lastly, the code here only refreshes during an active session, probably we could have a single pref SelfCheckRefresh that would trigger on the main page, default to 3 or 4 hours?
(In reply to Nick Clemens (kidclamp) from comment #4) > This patch moves the refresh code into a js include and sets a few variables > in the page. Did you write the JS file? It's not appearing in the patch. > Lastly, the code here only refreshes during an active session, probably we > could have a single pref > SelfCheckRefresh > that would trigger on the main page, default to 3 or 4 hours? As in, the current timeout is just an activity timeout to log them out? Yeah, I think a timer on the main page that defaults to even 1 time per hour would be good.
Created attachment 175239 [details] [review] Bug 36586: WIP This patch moves the refresh code into a js include and sets a few variables in the page. It also moves the fetch of the pref into the template. We need to copy this over for the sco - and probably add a new pref. Lastly, the code here only refreshes during an active session, probably we could have a single pref SelfCheckRefresh that would trigger on the main page, default to 3 or 4 hours?
(In reply to David Cook from comment #5) > (In reply to Nick Clemens (kidclamp) from comment #4) > Did you write the JS file? It's not appearing in the patch. heh, "git commit -a", but didn't add the new file ;-)
Comment on attachment 175239 [details] [review] Bug 36586: WIP Review of attachment 175239 [details] [review]: ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt @@ +274,4 @@ > }); > > > + let idleTimeout = [% Koha.Preference('SelfCheckInTimeOut') || 120 %]; There's a filter missing here. I noticed with the eyeballs and QA tools says it as well.
(In reply to Nick Clemens (kidclamp) from comment #7) > heh, "git commit -a", but didn't add the new file ;-) I've been writing a lot of new code on a different project, and I feel this pain haha
This WIP looks like it works for the existing functionality. But since we want timers for the borrower session and the SCO/SCI session, I'm thinking we should encapsulate the timers in objects. We'd create 2 objects, and then feed them their respective timer thresholds.
(In reply to David Cook from comment #10) > This WIP looks like it works for the existing functionality. > > But since we want timers for the borrower session and the SCO/SCI session, > I'm thinking we should encapsulate the timers in objects. We'd create 2 > objects, and then feed them their respective timer thresholds. I don't think I am quite sure what you mean here, JS objects? Koha Objects? Can you help with a patch or some pseudo code?
(In reply to Nick Clemens (kidclamp) from comment #11) > (In reply to David Cook from comment #10) > > This WIP looks like it works for the existing functionality. > > > > But since we want timers for the borrower session and the SCO/SCI session, > > I'm thinking we should encapsulate the timers in objects. We'd create 2 > > objects, and then feed them their respective timer thresholds. > > I don't think I am quite sure what you mean here, JS objects? Koha Objects? > Can you help with a patch or some pseudo code? Ah my bad. Yeah, JS objects. Sure, I'll look at doing a quick patch.
Created attachment 175919 [details] [review] Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode).
So the Javascript class here allows us to create multiple objects with the same code, so we can have the "window.sci_login_timer" which just governs the login timeout. But then we could easily create another timer for however many hours we want. (For that scenario, perhaps we'd actually want to set a higher interval than 1 second, and instead maybe check every minute or X minutes. Anyway, that's what I had in mind. I wrote it without jQuery, and I tweaked the conditions a bit, so that we're only invoking the timer where we need it in the first place rather than running it and checking for the button visibility on each increment. -- Also added in the missing TT filter and wrapper the idleTimeout in double quotes to avoid XSS.
Hey David, is this ready for testing?
(In reply to Lucas Gass (lukeg) from comment #15) > Hey David, is this ready for testing? Mmm... I think it could be tested, but really someone (myself or someone else) needs to add it for the SCO too. The "login_timeout" function could actually get moved to timeout.js too. At the moment, I'm just making an exception to CSRF for self-checks, so this hasn't been a priority for me. And actually... looking at this again... I think we've just refactored what's already there? I think this just redirects to the sci-main.pl after an inactivity timeout under some conditions. I don't think it would prevent the CSRF issue... So yeah... no not ready for testing, alas.
Created attachment 181645 [details] [review] Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off!
Created attachment 181646 [details] [review] Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off!
Created attachment 181694 [details] [review] Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! Signed-off-by: David Nind <david@davidnind.com>
Created attachment 181695 [details] [review] Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! Signed-off-by: David Nind <david@davidnind.com>
The thing I most noticed after the patches is that: 1. The self check-in page visible refreshes every 5 seconds. 2. The self check-out login page visible refreshes every 5 seconds. Before the patches, this did not happen. Testing notes (using KTD) ======================== Self check-in ------------- Self check-in (not enabled by default in KTD): 0. Enable the SelfCheckInModule system preference 1. Set SelfCheckinTimeout system preference to 5 2. http://127.0.0.1:8080/cgi-bin/koha/sci/sci-main.pl 3. Log in as the koha user (the password is koha) Before the patch: - you are logged out after 5 seconds - the self check-in page doesn't auto-refresh After the patch: - you are logged out after 5 seconds - self check-in page refreshes every 5 seconds (or the refresh is not visible) - the page doesn't refresh if you are typing in a barcode slowly Self check-out -------------- Self check-out (enabled by default in KTD): 1. Set SelfCheckTimout system preference to 5 2. URL: 127.0.0.1:8080/cgi-bin/koha/sco/sco-main.pl 3. Log in as the koha user (the password is koha) Before the patch: - you are logged out after 5 seconds - the self check-in page doesn't auto-refresh (or the refresh is not visible) - if you are logged in and have started typing in a barcode slowly, it logs you out - even if you haven't finished typing in a barcode After the patch: - you are logged out after 5 seconds, unless you interrupt it - the login page continues to refresh every 5 seconds - if you are logged in and have started typing in a barcode slowly, it no longer logs you out (it does if you don't enter anything after 5 seconds)
(In reply to David Nind from comment #21) > The thing I most noticed after the patches is that: > 1. The self check-in page visible refreshes every 5 seconds. > 2. The self check-out login page visible refreshes every 5 seconds. > > Before the patches, this did not happen. > Excellent! That is exactly what we want - a hard refresh to ensure the CSRF token is valid and that user info doesn't remain too long. 5 seconds is probably an extreme case, but the default of 2 minutes seems reasonable for this
Hey Nick, I just noticed you took over my authorship for that first patch haha. Fair enough though. Looks like it need some squashing down. I reckon that means I can probably QA this one too.
Created attachment 181874 [details] [review] Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Created attachment 181875 [details] [review] Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Nice clear fix. Passing QA
Hm, I don't quite understand how these happen? FAIL koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt FAIL tidiness File is not tidy, please run `perl misc/devel/tidy.pl koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt`
Tidy fails: kohadev-koha@kohadevbox:koha(main)$ perl misc/devel/tidy.pl koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt Tidying file 1/1 (koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt) [error] Sz8kRHIZ6p.tt: SyntaxError: CssSyntaxError: Unknown word (1:1) [error] > 1 | [% Koha.Preference('OPACUserCSS') | $raw %] [error] | ^ at misc/devel/tidy.pl line 112. Some files cannot be tidied: * koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt [error] Sz8kRHIZ6p.tt: SyntaxError: CssSyntaxError: Unknown word (1:1) [error] > 1 | [% Koha.Preference('OPACUserCSS') | $raw %] [error] | ^ Looks like a false positive, but can you please double check?
Created attachment 182022 [details] [review] Bug 36586: Fix tidy
QA script AND pre-commit hook must have caught that.
Created attachment 182023 [details] [review] Bug 36586: Define self-checkin timer using Javascript class This patch rewrites the self-checkin timer code to be defined in a Javascript class which is then instantiated in once in sci-main.pl depending on certain conditions (ie a barcode has been entered, or an item has been checked in by barcode). To test: 1 - Set SelfCheckinTimeout to a small value like 5 2 - Go to the self checkin: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl 3 - Sign in as the SCI user 4 - Watch the page, it should refresh every 5 seconds 5 - Confirm that moving the mouse/typing prevents the reset 6 - Check in an item 7 - Wait and confirm reload of main page happens when idle 8 - Confirm mouse/typing prevents refresh 9 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Bug 36586: Add sc-timer to sco This patch implements the timer form the last patch on the sco To test: 1 - Set SelfCheckTimout to 5 or something low for testing 2 - Go to the self checkout module 3 - Either sign in or confirm you have AutoSelfCheck user setup 4 - Observe the page reloads every 5 seocnds (or as you set above) 5 - Sign in as a patron 6 - Confirm on idle you are logged out to home page 7 - Sign off! Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Bug 36586: Fix tidy
We need to squash here.
Pushed for 25.05! Well done everyone, thank you!
We are excited to see this for 25.05! Could this be backported to 24.11?
I'm little late on this, but to me it seems that timeout doesn't currently work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just after few seconds. Changing greater value to SelfCheckInTimeout doesn't help. Also reloading the page takes sometimes a long time which can lead to situation where patron might try to log in while loading is still processed and their login credentials are swiped out after loading is finished.
(In reply to Emmi Takkinen from comment #35) > I'm little late on this, but to me it seems that timeout doesn't currently > work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just > after few seconds. Changing greater value to SelfCheckInTimeout doesn't > help. Also reloading the page takes sometimes a long time which can lead to > situation where patron might try to log in while loading is still processed > and their login credentials are swiped out after loading is finished. I'll take a quick look to see if I can reproduce.
(In reply to Emmi Takkinen from comment #35) > I'm little late on this, but to me it seems that timeout doesn't currently > work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just > after few seconds. Changing greater value to SelfCheckInTimeout doesn't > help. Also reloading the page takes sometimes a long time which can lead to > situation where patron might try to log in while loading is still processed > and their login credentials are swiped out after loading is finished. So you mention SelfCheckInTimeout and SCO in the same sentence, but the former belongs to the SCI feature and the latter is the SCO feature. They're two different things. SelfCheckTimeout is used for: http://localhost:8080/cgi-bin/koha/sco/sco-main.pl This is working correctly for me. It's taking the configured amount of time (e.g. 120 or 118 if I set that in SelfCheckTimeout) SelfCheckInTimeout is used for: http://localhost:8080/cgi-bin/koha/sci/sci-main.pl This is working correctly for me too. It's taking the configured amount of time (e.g. 120 or 111 as I set in SelfCheckInTimeout) -- The reload should also be very fast. If it's slow for you, it might be due to your server being very busy. Very weird that the SCO reloads just after few seconds. Sounds like you've got other problems with your Koha that you'll need to troubleshoot. Or maybe I'm not following the exact same steps as you and it works in many scenarios but not all? You can check the timer via the browser console using the following on the appropriate interface: console.log(window.sco_login_timer); console.log(window.sci_login_timer); That will show you the timeout threshold and the current idle time.
(In reply to David Cook from comment #37) > (In reply to Emmi Takkinen from comment #35) > > I'm little late on this, but to me it seems that timeout doesn't currently > > work as described. I have SelfCheckInTimeout set as 120 but SCO reloads just > > after few seconds. Changing greater value to SelfCheckInTimeout doesn't > > help. Also reloading the page takes sometimes a long time which can lead to > > situation where patron might try to log in while loading is still processed > > and their login credentials are swiped out after loading is finished. > > So you mention SelfCheckInTimeout and SCO in the same sentence, but the > former belongs to the SCI feature and the latter is the SCO feature. They're > two different things. > > SelfCheckTimeout is used for: > http://localhost:8080/cgi-bin/koha/sco/sco-main.pl > This is working correctly for me. It's taking the configured amount of time > (e.g. 120 or 118 if I set that in SelfCheckTimeout) > > SelfCheckInTimeout is used for: > http://localhost:8080/cgi-bin/koha/sci/sci-main.pl > This is working correctly for me too. It's taking the configured amount of > time (e.g. 120 or 111 as I set in SelfCheckInTimeout) > > -- Loading does work correctly, I just mixed up those two sysprefs with each other. So no problem there, sorry for that. > > The reload should also be very fast. If it's slow for you, it might be due > to your server being very busy. > > Very weird that the SCO reloads just after few seconds. Sounds like you've > got other problems with your Koha that you'll need to troubleshoot. > > Or maybe I'm not following the exact same steps as you and it works in many > scenarios but not all? > > You can check the timer via the browser console using the following on the > appropriate interface: > console.log(window.sco_login_timer); > console.log(window.sci_login_timer); > > That will show you the timeout threshold and the current idle time. I took a look at this again and actually loading isn't slow, page is just loaded again and again after first reload is done (seems to happen from 2 to up to 80 times). Then loading stops, page reloads again after 10 seconds (as set in syspref) and frequent loading starts again. But this only happens on my installation, not in sandboxes for example. No idea where this could come from but I'll provide a new bug report if it's Koha related problem.
Nice work everyone! Pushed to 24.11.x for 24.11.05
This patch may have broken the print slip function in SCO.
> I took a look at this again and actually loading isn't slow, page is just > loaded again and again after first reload is done (seems to happen from 2 to > up to 80 times). Then loading stops, page reloads again after 10 seconds (as > set in syspref) and frequent loading starts again. But this only happens on > my installation, not in sandboxes for example. No idea where this could come > from but I'll provide a new bug report if it's Koha related problem. We've had reports of the same. We've had partners in production have their servers become unusable because the self-checks are sending 50 logout requests a second.