Bug 41926 - Disable OPAC search form after first submitting it, as a counter measure to spam
Summary: Disable OPAC search form after first submitting it, as a counter measure to spam
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Lari Taskula
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-02-25 09:00 UTC by Lari Taskula
Modified: 2026-02-26 05:54 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Screencast to describe the problem (4.27 MB, video/webm)
2026-02-25 09:06 UTC, Lari Taskula
Details
Bug 41926: Add JS to prevent forms from resubmitting (1.52 KB, patch)
2026-02-25 10:03 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 41926: Prevent resubmits from masthead search form (1.93 KB, patch)
2026-02-25 10:03 UTC, Lari Taskula
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lari Taskula 2026-02-25 09:00:40 UTC
We occasionally notice the same search query being placed multiple times in rapid succession. While we do ratelimiting that eventually blocks the spam (whether intentional or not), the first counter measure should be to disable the form submit by JavaScript.

I propose once the search form is first submitted, we send the query and then disable the submit function. If patron then re-submits the form before search results are loaded, the browser will not send another query to Koha.

Now if anything changes within the form before the results are loaded, we re-enable the submit so that if they are quick enough, they could still modify their query before the results.
Comment 1 Lari Taskula 2026-02-25 09:06:05 UTC
Created attachment 193835 [details]
Screencast to describe the problem
Comment 2 Lari Taskula 2026-02-25 10:03:20 UTC
Created attachment 193838 [details] [review]
Bug 41926: Add JS to prevent forms from resubmitting
Comment 3 Lari Taskula 2026-02-25 10:03:22 UTC
Created attachment 193839 [details] [review]
Bug 41926: Prevent resubmits from masthead search form

To test:
0. Before applying this patch,
1. Open a console and run the following command
tail -f /var/log/apache2/other_vhosts_access.log -n 0 | grep 'GET /cgi-bin/koha/opac-search.pl'
2. Navigate to your OPAC main page
3. Observe "Search the catalog" text box and the green search icon to the right
4. Click the search icon as many times and as fast as you can
5. Observe the console window from step 1 having multiple requests
6. Apply patch,
7. Press Ctrl+C in your console and type "clear" (without quotes)"
8. Repeat steps 1-4
9. Observe the console window from step 1 only having one request
Comment 4 Lari Taskula 2026-02-25 10:21:29 UTC
(In reply to Lari Taskula from comment #0)
> Now if anything changes within the form before the results are loaded, we
> re-enable the submit so that if they are quick enough, they could still
> modify their query before the results.
This does leave room for spamming with the keyboard;

1. Activate the search field text box by clicking it, and very rapidly:
2. Press enter
3. Press a
4. Press enter
5. Press a
6. Press enter
7. ..repeat..

such that each enter press would send another request to the server.

We can either accept that, or we remove the proposed ability to resend the form if values change before the next page has loaded.
Comment 5 David Cook 2026-02-26 05:54:46 UTC
I think there's already a mechanism for this defined in koha-tmpl/opac-tmpl/bootstrap/js/global.js with jQuery.fn.preventDoubleFormSubmit

You can see an example at koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt

That said, it is a deprecated API, so we should probably update global.js at some point...