Bug 40224 - Replace use of location.href with POST logout form
Summary: Replace use of location.href with POST logout form
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Kyle M Hall (khall)
QA Contact: Testopia
URL:
Keywords:
Depends on: 36586
Blocks:
  Show dependency treegraph
 
Reported: 2025-06-24 11:26 UTC by Kyle M Hall (khall)
Modified: 2025-07-10 00:52 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40224: Replace use of location.href with POST logout form (6.39 KB, patch)
2025-06-24 11:30 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2025-06-24 11:26:55 UTC
The self-check module should use use POST for logouts instead of GET.
Comment 1 Kyle M Hall (khall) 2025-06-24 11:30:11 UTC
Created attachment 183443 [details] [review]
Bug 40224: Replace use of location.href with POST logout form

The self-check module should use use POST for logouts instead of GET.

Test Plan:
1) Enable WebBasedSelfCheck and SelfCheckInModule
2) Set SelfCheckTimeout and SelfCheckInTimeout to 10 seconds
3) Log in to each, observer the page is logged out after 10 seconds
   with not "op=logout" in the URL. Wait another 10 seconds, observe the
   page again refreshes with no "op=logout" in the URL.
Comment 2 David Nind 2025-06-24 19:54:02 UTC
Just checking if this is ready for sign off yet.
Comment 3 Kyle M Hall (khall) 2025-06-25 11:30:13 UTC
I'm concerned about issues with Bug 36586
Comment 4 David Cook 2025-07-10 00:00:17 UTC
Comment on attachment 183443 [details] [review]
Bug 40224: Replace use of location.href with POST logout form

Review of attachment 183443 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ +577,4 @@
>              // alert("checkout_confirm('" + patronid + "') called for barcode '" + barcode + "'");
>              if (! barcode) { dofocus(); return false; }    // no barcode
>              if (barcode == "__KOHA_NEW_CIRC__") {   // magic barcode
> +                $("#logout_post_form").submit();

Let's avoid jQuery

@@ +651,4 @@
>                      confirmModal("", _("Would you like to print a receipt?"), _("Print receipt and end session"), _("End session"), function(result) {
>                          if ( result && (Date.now() - confirmStart) < [% Koha.Preference('SelfCheckTimeout') | html %] ) {
>                              var win = window.open("/cgi-bin/koha/sco/printslip.pl?print=qslip");
> +                            $("#logout_post_form").submit();

Let's avoid jQuery

@@ +655,2 @@
>                          } else {
> +                            $("#logout_post_form").submit();

Let's avoid jQuery

@@ +657,4 @@
>                          }
>                      })
>                  [% ELSE %]
> +                    $("#logout_post_form").submit();

Let's avoid jQuery

::: koha-tmpl/opac-tmpl/bootstrap/js/timeout.js
@@ +31,4 @@
>      _timer_increment() {
>          this.idle_time++;
>          if (this.idle_time >= this.idle_timeout) {
> +            $("#" + this.form_id).submit();

Let's try to avoid jQuery. This is trivial to do with regular Javascript.
Comment 5 David Cook 2025-07-10 00:00:28 UTC
(In reply to Kyle M Hall (khall) from comment #0)
> The self-check module should use use POST for logouts instead of GET.

Makes sense!
Comment 6 David Cook 2025-07-10 00:52:23 UTC
(In reply to Kyle M Hall (khall) from comment #3)
> I'm concerned about issues with Bug 36586

Hopefully bug 40336 should fix those issues