To reproduce : 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected I'm not sure about the exact mechanism leading to a disconnection, but this is due to : > check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. This is true for all the results of: > git grep "check_cookie_auth.*cookie.*CGISESSID"
Created attachment 173361 [details] [review] Bug 38258: Force scalar context for cookie calls (part 1) To reproduce : 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected I'm not sure about the exact mechanism leading to a disconnection, but this is due to : > check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. This is true for all the results of: > git grep "check_cookie_auth.*cookie.*CGISESSID" Correct all the calls for cookies extracted from $input->cookie('CGISESSID') TEST PLAN: 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected 4 - Apply patch 5 - Repeat 1-3 and see you do not have been disconnected
Created attachment 173362 [details] [review] Bug 38258: Force scalar context for cookie calls (part 2) Correct all the calls for cookies extracted from $cgi->cookie('CGISESSID')
Created attachment 173363 [details] [review] Bug 38258: Force scalar context for cookie calls (part 3) Correct all the calls for cookies extracted from $query->cookie('CGISESSID')
Created attachment 173364 [details] [review] Bug 38258: Force scalar context for cookie calls (part 4) Correct the last call for cookies
Note: I do not pass QA for tidyness, I'm not sure it would be a good idea, tidyness requires to realign all "=" of each code block, which does not look like being in the scope of the patch
I had a go at testing. However, I wasn't able to replicate the issue using steps 1-3 from the test plan. I was NOT logged out of the staff interface when clicking any links. Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04.
I am skeptical about the analysis and patches for this one. Is this for the main branch or a stable branch?
(In reply to David Nind from comment #6) > I had a go at testing. > > However, I wasn't able to replicate the issue using steps 1-3 from the test > plan. > > I was NOT logged out of the staff interface when clicking any links. > > Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04. Hi ! What was your curl output ?
(In reply to David Cook from comment #7) > I am skeptical about the analysis and patches for this one. > > Is this for the main branch or a stable branch? This is for main, yes :) We had a very strange issue with some clients experiencing random disconnections.
(In reply to Baptiste Wojtkowski (bwoj) from comment #8) > (In reply to David Nind from comment #6) > > I had a go at testing. > > > > However, I wasn't able to replicate the issue using steps 1-3 from the test > > plan. > > > > I was NOT logged out of the staff interface when clicking any links. > > > > Tested using the latest Firefox, Chromium, and Google Chrome on Ubuntu 22.04. > > Hi ! What was your curl output ? Like David, I cannot reproduce this problem, when using koha-testing-docker. The curl output is a HTTP 403 error with a HTML page returned from Koha. -- Baptiste, can you try to reproduce this problem using koha-testing-docker?
(In reply to Baptiste Wojtkowski (bwoj) from comment #9) > We had a very strange issue with some clients experiencing random > disconnections. For older versions, there was a problem with C4::Context->userenv not being handled correctly, which could lead to 403 problems when using anti-CSRF. But that's not a problem in "main". Other than that... if your cleanup_database.pl overlaps with actual usage, you could have sessions deleted out of the database, which leads to seemingly random disconnections.
> Baptiste, can you try to reproduce this problem using koha-testing-docker? Hum.. It looks like it's time to take a look at ktd /o/ It might take a few weeks for me to be fully operational and provide the test plan.