We occasionally notice the same search query being placed multiple times in rapid succession. While we do ratelimiting that eventually blocks the spam (whether intentional or not), the first counter measure should be to disable the form submit by JavaScript. I propose once the search form is first submitted, we send the query and then disable the submit function. If patron then re-submits the form before search results are loaded, the browser will not send another query to Koha. Now if anything changes within the form before the results are loaded, we re-enable the submit so that if they are quick enough, they could still modify their query before the results.
Created attachment 193835 [details] Screencast to describe the problem
Created attachment 193838 [details] [review] Bug 41926: Add JS to prevent forms from resubmitting
Created attachment 193839 [details] [review] Bug 41926: Prevent resubmits from masthead search form To test: 0. Before applying this patch, 1. Open a console and run the following command tail -f /var/log/apache2/other_vhosts_access.log -n 0 | grep 'GET /cgi-bin/koha/opac-search.pl' 2. Navigate to your OPAC main page 3. Observe "Search the catalog" text box and the green search icon to the right 4. Click the search icon as many times and as fast as you can 5. Observe the console window from step 1 having multiple requests 6. Apply patch, 7. Press Ctrl+C in your console and type "clear" (without quotes)" 8. Repeat steps 1-4 9. Observe the console window from step 1 only having one request
(In reply to Lari Taskula from comment #0) > Now if anything changes within the form before the results are loaded, we > re-enable the submit so that if they are quick enough, they could still > modify their query before the results. This does leave room for spamming with the keyboard; 1. Activate the search field text box by clicking it, and very rapidly: 2. Press enter 3. Press a 4. Press enter 5. Press a 6. Press enter 7. ..repeat.. such that each enter press would send another request to the server. We can either accept that, or we remove the proposed ability to resend the form if values change before the next page has loaded.
I think there's already a mechanism for this defined in koha-tmpl/opac-tmpl/bootstrap/js/global.js with jQuery.fn.preventDoubleFormSubmit You can see an example at koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt That said, it is a deprecated API, so we should probably update global.js at some point...