Bug 5371 - Back-button in OPAC shows previous user's details, after logout
Summary: Back-button in OPAC shows previous user's details, after logout
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P3 major (vote)
Assignee: Jonathan Druart
QA Contact: Bugs List
URL:
Whiteboard:
Keywords:
: 13694 14799 (view as bug list)
Depends on:
Blocks:
 
Reported: 2010-11-07 12:10 UTC by Mason James
Modified: 2017-06-14 22:05 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
patch (2.09 KB, patch)
2010-11-07 12:31 UTC, Mason James
Details | Diff | Splinter Review
new patch (136 bytes, text/plain)
2011-07-27 22:33 UTC, Mason James
Details
Bug 5371: Force no caching for private pages at the OPAC (5.62 KB, patch)
2015-09-17 11:48 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 5371: Force no caching for private pages at the OPAC (5.62 KB, patch)
2015-09-28 11:33 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 5371: (follow-up) Force no caching for private pages at the OPAC (1.47 KB, patch)
2015-10-01 10:59 UTC, Jonathan Druart
Details | Diff | Splinter Review
[Signed-off] Bug 5371: Force no caching for private pages at the OPAC (5.80 KB, patch)
2015-10-01 11:39 UTC, Marc Véron
Details | Diff | Splinter Review
[Signed-off] Bug 5371: (follow-up) Force no caching for private pages at the OPAC (1.62 KB, patch)
2015-10-01 11:40 UTC, Marc Véron
Details | Diff | Splinter Review
[PASSED QA] Bug 5371: Force no caching for private pages at the OPAC (5.82 KB, patch)
2015-10-01 21:33 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 5371: (follow-up) Force no caching for private pages at the OPAC (1.67 KB, patch)
2015-10-01 21:35 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mason James 2010-11-07 12:10:08 UTC

    
Comment 1 Mason James 2010-11-07 12:31:39 UTC Comment hidden (obsolete)
Comment 2 Mason James 2010-11-07 12:49:03 UTC
patch applied to tag 'v3.02.00' 

this patch has only been tested in firefox so far, and requires a firefox config-change.

edit firefox's 'user.js' file and add this line to it
 user_pref("dom.allow_scripts_to_close_windows", true);

FYI: according to the web-security forums, this is the best/only way to get around this problem
Comment 3 Mason James 2010-11-07 13:21:52 UTC
> this patch has only been tested in firefox so far, 

this patch should work in google-chrome too (running in kiosk-mode)

http://www.google.co.nz/support/forum/p/Chrome/thread?tid=23c03746e3aa03f9&hl=en

i can't currently confirm this :/
Comment 4 Owen Leonard 2010-11-07 14:09:07 UTC
Could this be made a customization via OpacUserJS instead?
Comment 5 Mason James 2010-11-08 01:22:44 UTC
(In reply to comment #4)
> Could this be made a customization via OpacUserJS instead?

yes, there's a few ways to do it...

i think an on/off syspref is prolly the best way.
i think i'll resubmit the patch as a syspref
Comment 6 Mason James 2011-07-27 22:33:28 UTC Comment hidden (obsolete)
Comment 7 Mason James 2011-07-27 22:35:54 UTC
(In reply to comment #6)
> Created attachment 4761 [details]
> new patch

oops, wrong bug :) - ignore this patch for bug 6636
Comment 8 Mason James 2011-09-22 08:26:03 UTC
(In reply to comment #2)
> patch applied to tag 'v3.02.00' 
> 
> this patch has only been tested in firefox so far, and requires a firefox
> config-change.
> 
> edit firefox's 'user.js' file and add this line to it
>  user_pref("dom.allow_scripts_to_close_windows", true);
> 
> FYI: according to the web-security forums, this is the best/only way to get
> around this problem

an update on this bug...
ive come to a situation that i cant find a solution for

the patch works *perfectly* for browsers with the 'user_pref("dom.allow_scripts_to_close_windows")' pref set to 'TRUE'

so, the good news is library-staff can force this setting on their OPAC's browser, and this patch will work great!

the bad news is ... this  patch works horribly for browsers with the pref set to 'FALSE' (which is default)  and *fails* logging out a person :/

the obvious solution here is to test whether a browser has the 'dom.allow_scripts_to_close_windows' value set to TRUE then execute this js code, or not... 

sounds easy?, nope... 
i cant work out a technique to get the 'dom.allow_scripts_to_close_windows' value from a browser
(my hunch is that it's probably deliberately impossible to determine that info)

so, the original security/privacy issue still remains in MASTER -  but this patch is broken
Comment 9 Owen Leonard 2015-02-10 18:47:47 UTC
*** Bug 13694 has been marked as a duplicate of this bug. ***
Comment 10 Katrin Fischer 2015-09-09 19:43:27 UTC
*** Bug 14799 has been marked as a duplicate of this bug. ***
Comment 11 Marc Véron 2015-09-10 09:59:27 UTC
After a logout, there could be a message similar to the following:

"Logout privacy warning: Please close this browser window if other persons have access to this computer."
Comment 12 Mason James 2015-09-11 06:12:38 UTC
(In reply to Marc Véron from comment #11)
> After a logout, there could be a message similar to the following:
> 
> "Logout privacy warning: Please close this browser window if other persons
> have access to this computer."

Marc, this is a pretty good idea :)

silly me for only considering a technical solution
Comment 13 Jonathan Druart 2015-09-15 10:29:31 UTC
I have tried to set force_no_caching to output_html_with_http_headers, but I always get a "Document Expired" message from my browser (iceweasel), which is not really kind for users.
Comment 14 Jonathan Druart 2015-09-17 11:48:51 UTC Comment hidden (obsolete)
Comment 15 Jonathan Druart 2015-09-17 11:49:33 UTC
(In reply to Jonathan Druart from comment #13)
> I have tried to set force_no_caching to output_html_with_http_headers, but I
> always get a "Document Expired" message from my browser (iceweasel), which
> is not really kind for users.

Hum, it seems I haven't tested correctly yesterday, it works quite well :)
Comment 16 Marc Véron 2015-09-26 11:19:19 UTC
I get a software error.

To reproduce:
- Apply patch
- Log in to OPAC
- In left hand naigation, click on 'ask for a discharge'
Result:

Software error:
Global symbol "$query" requires explicit package name at /usr/share/kohaclone/opac/opac-discharge.pl line 102.
Comment 17 Jonathan Druart 2015-09-28 11:33:04 UTC Comment hidden (obsolete)
Comment 18 Jonathan Druart 2015-09-28 11:34:37 UTC
(In reply to Marc Véron from comment #16)
> I get a software error.
> 
> To reproduce:
> - Apply patch
> - Log in to OPAC
> - In left hand naigation, click on 'ask for a discharge'
> Result:
> 
> Software error:
> Global symbol "$query" requires explicit package name at
> /usr/share/kohaclone/opac/opac-discharge.pl line 102.

Oops, sorry about that Marc. Compulsive c/p always result in an error later...
Comment 19 Marc Véron 2015-09-28 16:09:42 UTC
With Firefox 40.0.3 (Win), I tested all left tabs by doing the following:

- Log in to OPAC
- Go to a tab at the left side
- Logout
- Hit browser's back button

Tabs tested:

- your summary: OK, however if you log in from the home page, then immediately log out and then hit the back button, the browser asks says 'Document expired (...) try again'. If you do so ('Send data again'), you are logged in. You can get the same after changing to other tabs by clicking the 'Back' button until you get 'Document expired...'

- your fines: OK *)

- your personal details: After hitting back button, I get Home > Register a new account. I would expect a login page or the home page

- your tags: After hitting back, I see the list of personal tags, patron seems to be logged in again (Name appears in Header). However if e.g. I try to delete a tag, I'm redirected to the Log in page

- change your password: OK*)

- your search history: 'Back' leads me back to Home > Search history with message 'Your catalog search history is empty'. I would expect a login page or the home page.

- your reading history: "Back" displays the Checkout history

- your privacy: OK*)

- your purchase suggestion: After 'Back', patron seems to be logged in (Name in header), but the page says: "You are not authorized to see pending purchase suggestions. If I then hit the link 'New purchase suggestion' I'm redirected to the page for anonymous suggestions (patron's name disappears from header).

- your messaging: After "Back", patron's messaging settings are displayed. If I change them ans submit changes, I get the log in screen




*) behalve of case explained under 'your summary'
Comment 20 Marc Véron 2015-09-28 16:15:34 UTC
Sorry, I saved the changes to early.

Further testing:

- your lists: Display after hitting "Back"

- ask for a discharche: OK behalve of case explained under 'your summary' in comment #19
Comment 21 Jonathan Druart 2015-10-01 10:59:35 UTC Comment hidden (obsolete)
Comment 22 Jonathan Druart 2015-10-01 11:03:06 UTC
Marc,
Thanks for testing.
I have added the trick on the messaging and circulation history page.
I have not changed the lists/shelves page, the module and script are going to be rewritten on another bug (bug 14544) and I don't want to introduce conflicts.

I am not sure we should add the no-store value for the cache policy on other pages.
Comment 23 Marc Véron 2015-10-01 11:39:32 UTC Comment hidden (obsolete)
Comment 24 Marc Véron 2015-10-01 11:40:57 UTC Comment hidden (obsolete)
Comment 25 Katrin Fischer 2015-10-01 21:33:47 UTC
Created attachment 43036 [details] [review]
[PASSED QA] Bug 5371: Force no caching for private pages at the OPAC

In order no to slow too much the browsing, it is certainly not a good
idea to add this cache-control value for all pages at the OPAC.

This patch just adds where the author found it could be useful.

Test plan:
1/ Login at the OPAC
2/ Go on the account page (opac/opac-account.pl)
3/ Click log out
4/ Use the back button of your browser
Without this patch you will see the previous page.
With this patch, the previous page will be reloaded and you will be
redirected to the login form.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 26 Katrin Fischer 2015-10-01 21:35:16 UTC
Created attachment 43037 [details] [review]
[PASSED QA] Bug 5371: (follow-up) Force no caching for private pages at the OPAC

Same as previous patch for opac-messaging.pl and opac-readingrecord.pl

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 27 Katrin Fischer 2015-10-01 21:40:34 UTC
Fixes a long existing security and privacy problem, but also changes behaviour a bit: when you are logged in and you try to use the back button, you will see a warning, that the browser won't automatically request the page again.
Comment 28 Jonathan Druart 2015-10-02 07:29:39 UTC
(In reply to Katrin Fischer from comment #27)
> Fixes a long existing security and privacy problem, but also changes
> behaviour a bit: when you are logged in and you try to use the back button,
> you will see a warning, that the browser won't automatically request the
> page again.

I don't remember I got a warning.
Comment 29 Katrin Fischer 2015-10-02 07:49:34 UTC
I tested a few times - maybe it's a firefox thing? I was using Firefox in Ubuntu. It was described as a privacy measure to not request pages not cached automatically again.
Comment 30 Kyle M Hall 2015-10-02 10:36:43 UTC
(In reply to Katrin Fischer from comment #29)
> I tested a few times - maybe it's a firefox thing? I was using Firefox in
> Ubuntu. It was described as a privacy measure to not request pages not
> cached automatically again.

I also was testing this patch using Chrome and Firefox on OS X. My experience is that some pages would give the "cache miss" error in both browsers and some would just redirect to the login screen.
Comment 31 Marc Véron 2015-10-02 12:18:59 UTC
(In reply to Kyle M Hall from comment #30)
> (In reply to Katrin Fischer from comment #29)
> > I tested a few times - maybe it's a firefox thing? I was using Firefox in
> > Ubuntu. It was described as a privacy measure to not request pages not
> > cached automatically again.
> 
> I also was testing this patch using Chrome and Firefox on OS X. My
> experience is that some pages would give the "cache miss" error in both
> browsers and some would just redirect to the login screen.

I think that happens if the page where you crawl back to is a page that was the result of a (log-in)form. See first point on comment #19

To reproduce (Firefox 40.1 Win / Chrome 45.0.2454.101 m / ):
- Close all browser windows to have a clear base line
- Open OPAC main page
- Log in as user AAAA with the login form at the right on the main page
- You are now on opac-user.pl
- Go to 'your fines'
- Log out
- You are redirected to the main page
- Hit back button
- You are now on opac-account.pl, it displays the login form
- Hit back button again
- In browser address field you have .../cgi-bin/koha/opac-user.pl 
  and the browser displays a message "Document expired... Try again"
- Hit "ry again"
- Brower displays a pop-up, something like "Send data again..." 
  with buttons 'Send again' / 'Cancel'
- Hit 'Send again'

Result:
- Firefox: ...you are logged in with user AAA and can browse to other pages
- Chrome: the message on .../cgi-bin/koha/opac-user.pl says something 
  like "Confirm sendign data again" and the string  ERR_CACHE_MISS
- IE: the message on .../cgi-bin/koha/opac-user.pl says something like
  'Webite expired... local copy no longer valid...

Fazit: The patches are fine to fix things for Chrome and IE (at least the version I tested), but with FF 40.1 I was able to get back again to a page with a valid login.

Since the browsers behave differently (maybe additionally depending on individual browser settings), I would like to repeat my proposition from comment #11 (in addition to the patches):

After a logout, display a message similar to the following:
"Logout privacy warning: Please close this browser window if other persons have access to this computer."
Comment 32 Tomás Cohen Arazi 2015-10-02 15:10:43 UTC
Patches pushed to master.

Thanks Jonathan!
Comment 33 Chris Cormack 2015-10-02 15:18:18 UTC
I agree with Marc that we need to also waen the users to close the browser, as I can confirm that this fix doesn't work for Firefox
Comment 34 Jonathan Druart 2015-10-05 07:29:22 UTC
(In reply to Chris Cormack from comment #33)
> I agree with Marc that we need to also waen the users to close the browser,
> as I can confirm that this fix doesn't work for Firefox

What version are you using?
Comment 35 Chris Cormack 2015-10-23 07:27:54 UTC
(In reply to Jonathan Druart from comment #34)
> (In reply to Chris Cormack from comment #33)
> > I agree with Marc that we need to also waen the users to close the browser,
> > as I can confirm that this fix doesn't work for Firefox
> 
> What version are you using?

It is now ok in the latest version, I am running firefox developer edition, 43.0a2
Comment 36 Galen Charlton 2015-12-04 18:08:13 UTC
Noting/requesting that as this patch fixes a patron privacy bug, it would be good it for it to be backported.  It cherry-picks cleanly onto 3.20.x and with only a minor merge conflict onto 3.18.x.
Comment 37 Frédéric Demians 2015-12-04 18:31:49 UTC
(In reply to Galen Charlton from comment #36)
> Noting/requesting that as this patch fixes a patron privacy bug, it would be
> good it for it to be backported.  It cherry-picks cleanly onto 3.20.x and
> with only a minor merge conflict onto 3.18.x.

What is the right process for this? Do I have to wait that 3.22 RMaint pushes this patch to its branch for pushing it to 3.20, or do I have to pick it up directly from master?
Comment 38 Katrin Fischer 2015-12-04 18:37:17 UTC
Hi Frederic, these patches are already in 3.22.
Comment 39 Frédéric Demians 2015-12-04 19:24:58 UTC
This patch has been pushed to 3.20.x, will be in 3.20.7.
Comment 40 Galen Charlton 2015-12-05 01:28:09 UTC
(In reply to Frédéric Demians from comment #39)
> This patch has been pushed to 3.20.x, will be in 3.20.7.

Thanks!
Comment 41 Liz Rea 2016-01-06 21:03:03 UTC
Pushed to 3.18.13, and released.