Created attachment 2733 [details] [review] patch
patch applied to tag 'v3.02.00' this patch has only been tested in firefox so far, and requires a firefox config-change. edit firefox's 'user.js' file and add this line to it user_pref("dom.allow_scripts_to_close_windows", true); FYI: according to the web-security forums, this is the best/only way to get around this problem
> this patch has only been tested in firefox so far, this patch should work in google-chrome too (running in kiosk-mode) http://www.google.co.nz/support/forum/p/Chrome/thread?tid=23c03746e3aa03f9&hl=en i can't currently confirm this :/
Could this be made a customization via OpacUserJS instead?
(In reply to comment #4) > Could this be made a customization via OpacUserJS instead? yes, there's a few ways to do it... i think an on/off syspref is prolly the best way. i think i'll resubmit the patch as a syspref
Created attachment 4761 [details] new patch
(In reply to comment #6) > Created attachment 4761 [details] > new patch oops, wrong bug :) - ignore this patch for bug 6636
(In reply to comment #2) > patch applied to tag 'v3.02.00' > > this patch has only been tested in firefox so far, and requires a firefox > config-change. > > edit firefox's 'user.js' file and add this line to it > user_pref("dom.allow_scripts_to_close_windows", true); > > FYI: according to the web-security forums, this is the best/only way to get > around this problem an update on this bug... ive come to a situation that i cant find a solution for the patch works *perfectly* for browsers with the 'user_pref("dom.allow_scripts_to_close_windows")' pref set to 'TRUE' so, the good news is library-staff can force this setting on their OPAC's browser, and this patch will work great! the bad news is ... this patch works horribly for browsers with the pref set to 'FALSE' (which is default) and *fails* logging out a person :/ the obvious solution here is to test whether a browser has the 'dom.allow_scripts_to_close_windows' value set to TRUE then execute this js code, or not... sounds easy?, nope... i cant work out a technique to get the 'dom.allow_scripts_to_close_windows' value from a browser (my hunch is that it's probably deliberately impossible to determine that info) so, the original security/privacy issue still remains in MASTER - but this patch is broken
*** Bug 13694 has been marked as a duplicate of this bug. ***
*** Bug 14799 has been marked as a duplicate of this bug. ***
After a logout, there could be a message similar to the following: "Logout privacy warning: Please close this browser window if other persons have access to this computer."
(In reply to Marc Véron from comment #11) > After a logout, there could be a message similar to the following: > > "Logout privacy warning: Please close this browser window if other persons > have access to this computer." Marc, this is a pretty good idea :) silly me for only considering a technical solution
I have tried to set force_no_caching to output_html_with_http_headers, but I always get a "Document Expired" message from my browser (iceweasel), which is not really kind for users.
Created attachment 42648 [details] [review] Bug 5371: Force no caching for private pages at the OPAC In order no to slow too much the browsing, it is certainly not a good idea to add this cache-control value for all pages at the OPAC. This patch just adds where the author found it could be useful. Test plan: 1/ Login at the OPAC 2/ Go on the account page (opac/opac-account.pl) 3/ Click log out 4/ Use the back button of your browser Without this patch you will see the previous page. With this patch, the previous page will be reloaded and you will be redirected to the login form.
(In reply to Jonathan Druart from comment #13) > I have tried to set force_no_caching to output_html_with_http_headers, but I > always get a "Document Expired" message from my browser (iceweasel), which > is not really kind for users. Hum, it seems I haven't tested correctly yesterday, it works quite well :)
I get a software error. To reproduce: - Apply patch - Log in to OPAC - In left hand naigation, click on 'ask for a discharge' Result: Software error: Global symbol "$query" requires explicit package name at /usr/share/kohaclone/opac/opac-discharge.pl line 102.
Created attachment 42911 [details] [review] Bug 5371: Force no caching for private pages at the OPAC In order no to slow too much the browsing, it is certainly not a good idea to add this cache-control value for all pages at the OPAC. This patch just adds where the author found it could be useful. Test plan: 1/ Login at the OPAC 2/ Go on the account page (opac/opac-account.pl) 3/ Click log out 4/ Use the back button of your browser Without this patch you will see the previous page. With this patch, the previous page will be reloaded and you will be redirected to the login form.
(In reply to Marc Véron from comment #16) > I get a software error. > > To reproduce: > - Apply patch > - Log in to OPAC > - In left hand naigation, click on 'ask for a discharge' > Result: > > Software error: > Global symbol "$query" requires explicit package name at > /usr/share/kohaclone/opac/opac-discharge.pl line 102. Oops, sorry about that Marc. Compulsive c/p always result in an error later...
With Firefox 40.0.3 (Win), I tested all left tabs by doing the following: - Log in to OPAC - Go to a tab at the left side - Logout - Hit browser's back button Tabs tested: - your summary: OK, however if you log in from the home page, then immediately log out and then hit the back button, the browser asks says 'Document expired (...) try again'. If you do so ('Send data again'), you are logged in. You can get the same after changing to other tabs by clicking the 'Back' button until you get 'Document expired...' - your fines: OK *) - your personal details: After hitting back button, I get Home > Register a new account. I would expect a login page or the home page - your tags: After hitting back, I see the list of personal tags, patron seems to be logged in again (Name appears in Header). However if e.g. I try to delete a tag, I'm redirected to the Log in page - change your password: OK*) - your search history: 'Back' leads me back to Home > Search history with message 'Your catalog search history is empty'. I would expect a login page or the home page. - your reading history: "Back" displays the Checkout history - your privacy: OK*) - your purchase suggestion: After 'Back', patron seems to be logged in (Name in header), but the page says: "You are not authorized to see pending purchase suggestions. If I then hit the link 'New purchase suggestion' I'm redirected to the page for anonymous suggestions (patron's name disappears from header). - your messaging: After "Back", patron's messaging settings are displayed. If I change them ans submit changes, I get the log in screen *) behalve of case explained under 'your summary'
Sorry, I saved the changes to early. Further testing: - your lists: Display after hitting "Back" - ask for a discharche: OK behalve of case explained under 'your summary' in comment #19
Created attachment 43002 [details] [review] Bug 5371: (follow-up) Force no caching for private pages at the OPAC Same as previous patch for opac-messaging.pl and opac-readingrecord.pl
Marc, Thanks for testing. I have added the trick on the messaging and circulation history page. I have not changed the lists/shelves page, the module and script are going to be rewritten on another bug (bug 14544) and I don't want to introduce conflicts. I am not sure we should add the no-store value for the cache policy on other pages.
Created attachment 43004 [details] [review] [Signed-off] Bug 5371: Force no caching for private pages at the OPAC In order no to slow too much the browsing, it is certainly not a good idea to add this cache-control value for all pages at the OPAC. This patch just adds where the author found it could be useful. Test plan: 1/ Login at the OPAC 2/ Go on the account page (opac/opac-account.pl) 3/ Click log out 4/ Use the back button of your browser Without this patch you will see the previous page. With this patch, the previous page will be reloaded and you will be redirected to the login form. Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 43005 [details] [review] [Signed-off] Bug 5371: (follow-up) Force no caching for private pages at the OPAC Same as previous patch for opac-messaging.pl and opac-readingrecord.pl Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 43036 [details] [review] [PASSED QA] Bug 5371: Force no caching for private pages at the OPAC In order no to slow too much the browsing, it is certainly not a good idea to add this cache-control value for all pages at the OPAC. This patch just adds where the author found it could be useful. Test plan: 1/ Login at the OPAC 2/ Go on the account page (opac/opac-account.pl) 3/ Click log out 4/ Use the back button of your browser Without this patch you will see the previous page. With this patch, the previous page will be reloaded and you will be redirected to the login form. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 43037 [details] [review] [PASSED QA] Bug 5371: (follow-up) Force no caching for private pages at the OPAC Same as previous patch for opac-messaging.pl and opac-readingrecord.pl Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Fixes a long existing security and privacy problem, but also changes behaviour a bit: when you are logged in and you try to use the back button, you will see a warning, that the browser won't automatically request the page again.
(In reply to Katrin Fischer from comment #27) > Fixes a long existing security and privacy problem, but also changes > behaviour a bit: when you are logged in and you try to use the back button, > you will see a warning, that the browser won't automatically request the > page again. I don't remember I got a warning.
I tested a few times - maybe it's a firefox thing? I was using Firefox in Ubuntu. It was described as a privacy measure to not request pages not cached automatically again.
(In reply to Katrin Fischer from comment #29) > I tested a few times - maybe it's a firefox thing? I was using Firefox in > Ubuntu. It was described as a privacy measure to not request pages not > cached automatically again. I also was testing this patch using Chrome and Firefox on OS X. My experience is that some pages would give the "cache miss" error in both browsers and some would just redirect to the login screen.
(In reply to Kyle M Hall from comment #30) > (In reply to Katrin Fischer from comment #29) > > I tested a few times - maybe it's a firefox thing? I was using Firefox in > > Ubuntu. It was described as a privacy measure to not request pages not > > cached automatically again. > > I also was testing this patch using Chrome and Firefox on OS X. My > experience is that some pages would give the "cache miss" error in both > browsers and some would just redirect to the login screen. I think that happens if the page where you crawl back to is a page that was the result of a (log-in)form. See first point on comment #19 To reproduce (Firefox 40.1 Win / Chrome 45.0.2454.101 m / ): - Close all browser windows to have a clear base line - Open OPAC main page - Log in as user AAAA with the login form at the right on the main page - You are now on opac-user.pl - Go to 'your fines' - Log out - You are redirected to the main page - Hit back button - You are now on opac-account.pl, it displays the login form - Hit back button again - In browser address field you have .../cgi-bin/koha/opac-user.pl and the browser displays a message "Document expired... Try again" - Hit "ry again" - Brower displays a pop-up, something like "Send data again..." with buttons 'Send again' / 'Cancel' - Hit 'Send again' Result: - Firefox: ...you are logged in with user AAA and can browse to other pages - Chrome: the message on .../cgi-bin/koha/opac-user.pl says something like "Confirm sendign data again" and the string ERR_CACHE_MISS - IE: the message on .../cgi-bin/koha/opac-user.pl says something like 'Webite expired... local copy no longer valid... Fazit: The patches are fine to fix things for Chrome and IE (at least the version I tested), but with FF 40.1 I was able to get back again to a page with a valid login. Since the browsers behave differently (maybe additionally depending on individual browser settings), I would like to repeat my proposition from comment #11 (in addition to the patches): After a logout, display a message similar to the following: "Logout privacy warning: Please close this browser window if other persons have access to this computer."
Patches pushed to master. Thanks Jonathan!
I agree with Marc that we need to also waen the users to close the browser, as I can confirm that this fix doesn't work for Firefox
(In reply to Chris Cormack from comment #33) > I agree with Marc that we need to also waen the users to close the browser, > as I can confirm that this fix doesn't work for Firefox What version are you using?
(In reply to Jonathan Druart from comment #34) > (In reply to Chris Cormack from comment #33) > > I agree with Marc that we need to also waen the users to close the browser, > > as I can confirm that this fix doesn't work for Firefox > > What version are you using? It is now ok in the latest version, I am running firefox developer edition, 43.0a2
Noting/requesting that as this patch fixes a patron privacy bug, it would be good it for it to be backported. It cherry-picks cleanly onto 3.20.x and with only a minor merge conflict onto 3.18.x.
(In reply to Galen Charlton from comment #36) > Noting/requesting that as this patch fixes a patron privacy bug, it would be > good it for it to be backported. It cherry-picks cleanly onto 3.20.x and > with only a minor merge conflict onto 3.18.x. What is the right process for this? Do I have to wait that 3.22 RMaint pushes this patch to its branch for pushing it to 3.20, or do I have to pick it up directly from master?
Hi Frederic, these patches are already in 3.22.
This patch has been pushed to 3.20.x, will be in 3.20.7.
(In reply to Frédéric Demians from comment #39) > This patch has been pushed to 3.20.x, will be in 3.20.7. Thanks!
Pushed to 3.18.13, and released.