See 37041/40943. On 40943 we check the correct session id now. But we still should not hit those value builder pages directly and generate 500s. But the login problem of 37041 has been addressed.
Created attachment 187723 [details] [review] Bug 40993: Add Apache RewriteRule for hitting value_builder pages Test plan: Copy this file to /etc/koha. Restart Apache. Login to staff and hit a value builder page directly, e.g.: YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl Verify that you got redirected to 403. Verify that you can still edit a biblio record and open e.g. the leader plugin form. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Your follow-up here would be appreciated. Thanks.
(In reply to Marcel de Rooy from comment #2) > Your follow-up here would be appreciated. Thanks. Catching up on my emails, but I'm adding a note to review this as soon as I can. At a glance, it looks pretty good although I think I might have a change to make.
Removing the dependency on bug 40943 because it doesn't require it to function. Moving it to See Also instead. Before the patch, I go to http://localhost:8081/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl and it gives me a 500 With the patch: - sudo cp debian/templates/apache-shared-intranet.conf /etc/koha/apache-shared-intranet.conf - sudo service apache2 restart And that doesn't work because KTD doesn't use /etc/koha/apache-shared-intranet.conf it uses /etc/koha/apache-shared-intranet-git.conf So I'll manually include the line into /etc/koha/apache-shared-intranet-git.conf And that's looking good. I just have one tweak to make.
Created attachment 188185 [details] [review] Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action Signed-off-by: David Cook <dcook@prosentient.com.au>
Created attachment 188186 [details] [review] Bug 40993: Add Apache RewriteRule for hitting value_builder pages Test plan: Copy this file to /etc/koha. Restart Apache. Login to staff and hit a value builder page directly, e.g.: YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl Verify that you got redirected to 403. Verify that you can still edit a biblio record and open e.g. the leader plugin form. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Cook <dcook@prosentient.com.au>
Created attachment 188187 [details] [review] Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action Signed-off-by: David Cook <dcook@prosentient.com.au>
(In reply to David Cook from comment #7) > Created attachment 188187 [details] [review] [review] > Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action > > Signed-off-by: David Cook <dcook@prosentient.com.au> Ah great, thx.
Created attachment 190284 [details] [review] Bug 40993: Add Apache RewriteRule for hitting value_builder pages Test plan: Copy this file to /etc/koha. Restart Apache. Login to staff and hit a value builder page directly, e.g.: YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl Verify that you got redirected to 403. Verify that you can still edit a biblio record and open e.g. the leader plugin form. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Created attachment 190285 [details] [review] Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Nice work everyone! Pushed to main for 26.05
Tests are failing here now: ( xt/check_apache_conf.t ) # Subtest: Intranet RewriteRule statements 1..1 not ok 1 - All RewriteRule and RewriteCond directives must be copied to etc/koha-httpd.conf # Failed test 'All RewriteRule and RewriteCond directives must be copied to etc/koha-httpd.conf' # at /kohadevbox/koha/xt/check_apache_conf.t line 46. # got: '1' # expected: '0' # RewriteRule ^/cgi-bin/koha/cataloguing/value_builder/ /cgi-bin/koha/errors/403.pl [L,PT] # Looks like you failed 1 test of 1. not ok 1 - Intranet RewriteRule statements
Will have a look
Created attachment 191367 [details] [review] Bug 40993: (follow-up) Add changes to etc/koha-httpd.conf Good to have a test :) Test plan: Run xt/check_apache_conf.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 191368 [details] [review] Bug 40993: Update etc/koha-httpd.conf
follow-up pushed to main