Bug 40980 - Clicking a search facet without logging in may trigger a cud-login error
Summary: Clicking a search facet without logging in may trigger a cud-login error
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Searching - Elasticsearch (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Pedro Amorim
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-10-09 08:29 UTC by Pedro Amorim
Modified: 2025-12-01 00:59 UTC (History)
6 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40980: Only consider AND|OR|NOT/i operators (1.43 KB, patch)
2025-10-09 08:33 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 40980: Only consider AND|OR|NOT/i operators (1.48 KB, patch)
2025-11-08 03:52 UTC, David Nind
Details | Diff | Splinter Review
Bug 40980: Only consider AND|OR|NOT/i operators (1.49 KB, patch)
2025-11-20 12:35 UTC, Pedro Amorim
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pedro Amorim 2025-10-09 08:29:31 UTC

    
Comment 1 Pedro Amorim 2025-10-09 08:33:08 UTC
Created attachment 187634 [details] [review]
Bug 40980: Only consider AND|OR|NOT/i operators

Test plan, k-t-d with elastic search:
1) Make sure you're logged out
2) Access a search results page directly e.g.:
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music
3) You're prompted to login, login.
4) You're shown the search results directly, click a facet result (any facet)
5) You get a Error 403:
Programming error - op 'cud-login' must not start with 'cud-' for GET
6) Apply patch, restart plack, repeat
Comment 2 David Nind 2025-11-08 03:52:08 UTC
Created attachment 189384 [details] [review]
Bug 40980: Only consider AND|OR|NOT/i operators

Test plan, k-t-d with elastic search:
1) Make sure you're logged out
2) Access a search results page directly e.g.:
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music
3) You're prompted to login, login.
4) You're shown the search results directly, click a facet result (any facet)
5) You get a Error 403:
Programming error - op 'cud-login' must not start with 'cud-' for GET
6) Apply patch, restart plack, repeat

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Pedro Amorim 2025-11-20 12:35:38 UTC
Created attachment 189766 [details] [review]
Bug 40980: Only consider AND|OR|NOT/i operators

Test plan, k-t-d with elastic search:
1) Make sure you're logged out
2) Access a search results page directly e.g.:
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music
3) You're prompted to login, login.
4) You're shown the search results directly, click a facet result (any facet)
5) You get a Error 403:
Programming error - op 'cud-login' must not start with 'cud-' for GET
6) Apply patch, restart plack, repeat

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 Marcel de Rooy 2025-11-28 10:47:56 UTC
Please explain the relation of this otor with op=cud-login ?
Comment 5 Pedro Amorim 2025-11-28 12:43:10 UTC
(In reply to Marcel de Rooy from comment #4)
> Please explain the relation of this otor with op=cud-login ?

Hi Marcel yes, of course, this is what I shared with my colleagues internally when diagnosing/fixing this issue almost 2 months ago:

op=cud-login is always POSTed when logging in, but because for ElasticSearch an op may be AND OR or NOT it adds it to the facet link, thus causing it to be added to the URL as GET and causing the error. This is my fix for now, but there may be a better approach.

------

Upon looking at it again, my analysis remains the same, but I'll explain again phrasing it differently.
'op' is a param that ElasticSearch considers for building the search query (AND, OR or NOT), but 'op' is also what we use for POST cud-login (and other form submissions).
With the above in mind, in Koha, when we're logged out and attempt to access a URL with a GET parameter, e.g. http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=19. We're prompted to login, and after login we're brought to the borrowernumber 19 page, but if we look at the URL, we see that it looks like this:
http://localhost:8081/cgi-bin/koha/circ/circulation.pl. This means borrowernumber=19 was passed onto circulation.pl as a POST parameter, not as GET.

This is what I think is happening to the ElasticSearch issue above, op='cud-login' is passed to search.pl as a POST param (can be confirmed by the network browser tab) which then causes the following code in facets.inc to add the op=cud-login to the facet link as a GET param:
[% SET url = "/cgi-bin/koha/catalogue/search.pl?" _ query_cgi _ limit_cgi %]

Because query_cgi contains the problematic op=cud-login, seemingly not distinguishing between GET and POST params, if it matters here at all.

I've explained the issue the best I can (and to the best of my knowledge), and I'm happy to discuss my patch further and/or other alternative patches.