Bug 38258 - Connecting without a proper CGI cookie can disconnect all sessions
Summary: Connecting without a proper CGI cookie can disconnect all sessions
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Baptiste Wojtkowski (bwoj)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-24 12:56 UTC by Baptiste Wojtkowski (bwoj)
Modified: 2024-11-05 16:51 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 38258: Force scalar context for cookie calls (part 1) (21.51 KB, patch)
2024-10-25 14:00 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 38258: Force scalar context for cookie calls (part 2) (6.04 KB, patch)
2024-10-25 14:00 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 38258: Force scalar context for cookie calls (part 3) (4.14 KB, patch)
2024-10-25 14:00 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 38258: Force scalar context for cookie calls (part 4) (1.01 KB, patch)
2024-10-25 14:00 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Baptiste Wojtkowski (bwoj) 2024-10-24 12:56:34 UTC
To reproduce :

1 - Log in to Koha intranet keep the browser open
2 - Run in a terminal: curl  --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd'
Note: there is no need to have a valid thumbnail and biblionumber
3 - Go back to your browser and click any link: you have been disconnected


I'm not sure about the exact mechanism leading to a disconnection, but this is due to :

> check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );

If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue.

This is true for all the results of:

> git grep "check_cookie_auth.*cookie.*CGISESSID"
Comment 1 Baptiste Wojtkowski (bwoj) 2024-10-25 14:00:42 UTC
Created attachment 173361 [details] [review]
Bug 38258: Force scalar context for cookie calls (part 1)

To reproduce :

1 - Log in to Koha intranet keep the browser open
2 - Run in a terminal: curl  --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd'
Note: there is no need to have a valid thumbnail and biblionumber
3 - Go back to your browser and click any link: you have been disconnected

I'm not sure about the exact mechanism leading to a disconnection, but this is due to :

> check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );

If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue.

This is true for all the results of:

> git grep "check_cookie_auth.*cookie.*CGISESSID"

Correct all the calls for cookies extracted from $input->cookie('CGISESSID')

TEST PLAN:
1 - Log in to Koha intranet keep the browser open
2 - Run in a terminal: curl  --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd'
Note: there is no need to have a valid thumbnail and biblionumber
3 - Go back to your browser and click any link: you have been disconnected
4 - Apply patch
5 - Repeat 1-3 and see you do not have been disconnected
Comment 2 Baptiste Wojtkowski (bwoj) 2024-10-25 14:00:44 UTC
Created attachment 173362 [details] [review]
Bug 38258: Force scalar context for cookie calls (part 2)

Correct all the calls for cookies extracted from $cgi->cookie('CGISESSID')
Comment 3 Baptiste Wojtkowski (bwoj) 2024-10-25 14:00:46 UTC
Created attachment 173363 [details] [review]
Bug 38258: Force scalar context for cookie calls (part 3)

Correct all the calls for cookies extracted from $query->cookie('CGISESSID')
Comment 4 Baptiste Wojtkowski (bwoj) 2024-10-25 14:00:49 UTC
Created attachment 173364 [details] [review]
Bug 38258: Force scalar context for cookie calls (part 4)

Correct the last call for cookies
Comment 5 Baptiste Wojtkowski (bwoj) 2024-10-25 14:02:27 UTC
Note: I do not pass QA for tidyness, I'm not sure it would be a good idea, tidyness requires to realign all "=" of each code block, which does not look like being in the scope of the patch
Comment 6 David Nind 2024-10-25 19:05:59 UTC
I had a go at testing.

However, I wasn't able to replicate the issue using steps 1-3 from the test plan.

I was NOT logged out of the staff interface when clicking any links. 

Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04.
Comment 7 David Cook 2024-10-27 23:55:43 UTC
I am skeptical about the analysis and patches for this one.

Is this for the main branch or a stable branch?
Comment 8 Baptiste Wojtkowski (bwoj) 2024-10-28 09:08:51 UTC
(In reply to David Nind from comment #6)
> I had a go at testing.
> 
> However, I wasn't able to replicate the issue using steps 1-3 from the test
> plan.
> 
> I was NOT logged out of the staff interface when clicking any links. 
> 
> Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04.

Hi ! What was your curl output ?
Comment 9 Baptiste Wojtkowski (bwoj) 2024-10-28 09:10:24 UTC
(In reply to David Cook from comment #7)
> I am skeptical about the analysis and patches for this one.
> 
> Is this for the main branch or a stable branch?

This is for main, yes :)
We had a very strange issue with some clients experiencing random disconnections.
Comment 10 David Cook 2024-10-29 00:57:51 UTC
(In reply to Baptiste Wojtkowski (bwoj) from comment #8)
> (In reply to David Nind from comment #6)
> > I had a go at testing.
> > 
> > However, I wasn't able to replicate the issue using steps 1-3 from the test
> > plan.
> > 
> > I was NOT logged out of the staff interface when clicking any links. 
> > 
> > Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04.
> 
> Hi ! What was your curl output ?

Like David, I cannot reproduce this problem, when using koha-testing-docker.

The curl output is a HTTP 403 error with a HTML page returned from Koha.

--

Baptiste, can you try to reproduce this problem using koha-testing-docker?
Comment 11 David Cook 2024-10-29 01:00:15 UTC
(In reply to Baptiste Wojtkowski (bwoj) from comment #9)
> We had a very strange issue with some clients experiencing random
> disconnections.

For older versions, there was a problem with C4::Context->userenv not being handled correctly, which could lead to 403 problems when using anti-CSRF. But that's not a problem in "main".

Other than that... if your cleanup_database.pl overlaps with actual usage, you could have sessions deleted out of the database, which leads to seemingly random disconnections.
Comment 12 Baptiste Wojtkowski (bwoj) 2024-11-05 16:51:30 UTC
> Baptiste, can you try to reproduce this problem using koha-testing-docker?

Hum.. It looks like it's time to take a look at ktd /o/ It might take a few weeks for me to be fully operational and provide the test plan.