https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43709
Bug ID: 43709
Summary: Cataloging: intermittent 400/403 error when switching
MARC framework in the basic editor (addbiblio.pl)
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Cataloging
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
In the basic MARC editor (cataloguing/addbiblio.pl), switching the
framework from the "Settings" dropdown (.change-framework links)
intermittently fails with a 400 or 403 error instead of reloading the
form with the new framework. The failure is frequent but not
systematic.
Two independent causes combine to produce this:
1. Missing e.preventDefault() on the .change-framework click handler.
Changefwk() submits the form via POST, but the triggering link
(href="#") is never cancelled. Depending on browser/timing, the
hash navigation can race with the form submit, and the server can
end up receiving a GET request instead of POST. The CSRF
middleware rejects any GET request carrying op=cud-* => 400.
2. CSRF token invalidated by browser bfcache. The CSRF token
(Koha::Token, see _add_default_csrf_params in Koha/Token.pm) is
tied to userid + '_' + session_id. If the session changes while
the page is open (session expiry followed by a new session,
logout in another tab, or external session cleanup) and the
browser serves the page from bfcache with the old embedded token,
validation fails => 403. addbiblio.pl's Cache-Control: no-cache
(without no-store) does not prevent bfcache from serving the page.
Steps to reproduce (#2, the more reliably reproducible of the two):
1. Open the basic MARC editor for a record (cataloguing/addbiblio.pl)
in a tab.
2. In another tab, log out, or let the session expire, or otherwise
invalidate the current session (e.g. restart Plack / clear
sessions table).
3. Navigate away from the editor tab and back (browser back/forward,
or close and reopen via history) so it is served from bfcache
with the stale CSRF token still embedded.
4. Use "Settings" > switch framework. The request fails with 403
(or the page behaves as if nothing happened, depending on how the
browser renders the cached state).
#1 is timing/browser-dependent and harder to force deterministically
from the UI; it was identified by code audit of the click handler
(.change-framework lacks preventDefault while the <a href="#"> stays
a live navigation target).
Proposed fix (4 independent, complementary changes):
1. addbiblio.tt: add e.preventDefault() to the .change-framework
click handler, so the href="#" navigation never competes with the
POST submit.
2. addbiblio.tt: store the page's CGISESSID cookie value on load;
before submitting via Changefwk(), compare it to the current
cookie and reload the page instead of submitting if it changed.
3. addbiblio.tt: add a 'pageshow' listener that reloads the page
when event.persisted is true (page served from bfcache), so a
stale CSRF token is never submitted.
4. addbiblio.pl: pass { force_no_caching => 1 } to both
output_html_with_http_headers calls, adding Cache-Control:
no-store so the page is excluded from bfcache in browsers that
honor it.
Bug 37745 and Bug 34478 fixed earlier problems with the framework
switch (duplicated CSS class, missing CSRF token), but these two
issues were not caught by either.
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
