gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
62,369 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Martin Renvoize 537a64a01b
Bug 42634: Force JWT cookie deletion on self-checkout logout 
The web-based self-checkout (opac/sco/sco-main.pl) builds the
response JWT cookie with -expires => $jwt ? '+1d' : ''. On logout
$jwt is undef, so the cookie is sent with an empty value and no
Expires attribute - i.e. a session cookie with an empty value
rather than a deletion. Some browsers/proxies retain the previous
valid JWT in this scenario, which presents as the Finish/close
button "doing nothing" or working only intermittently: the patron
appears to remain logged in despite clicking Finish.

Use a past Expires ('-1d') when no JWT is present so the browser
deletes the cookie entirely. The subsequent ?op=logout render
cannot then rediscover the patron from a stale cookie.

Test plan:
1. Enable web-based self-checkout (SelfCheckoutByLogin or
   SelfCheckAllowByIPRanges).
2. Log in as a patron at /cgi-bin/koha/sco/sco-main.pl.
3. Open DevTools -> Application -> Cookies and note the JWT cookie.
4. Click the green "Finish" button.
5. Without the patch: Set-Cookie on the ?op=logout response shows
   JWT= with no Expires; the cookie persists as an empty session
   cookie.
6. With the patch: Set-Cookie shows JWT=; expires=<past date>; the
   browser removes the cookie entirely.
7. Confirm the kiosk reliably returns to the login screen and
   subsequent page loads do not re-authenticate from a stale JWT.

Sponsored-by: OpenFifth
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
 		2026-08-28 16:36:34 +00:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-06 09:15:26 -06:00
C4 Bug 39959: Add a total column to the invoices table 2026-08-25 08:56:32 +00:00
Koha Bug 30144: (QA follow-up) Exclude servicing_instruction from order API representation 2026-08-28 16:36:28 +00:00
acqui Bug 30144: (QA follow-up) Fix stored XSS in servicing instructions 2026-08-28 16:36:26 +00:00
admin Bug 30144: Add UI for servicing instructions 2026-08-28 16:36:22 +00:00
api Bug 42207: Allow library embed on GET /patrons/{patron_id} 2026-08-21 15:58:25 +00:00
authorities Bug 21453: Copy data to the correct subfields when linking authorities with authorities 2026-04-23 09:24:58 -06:00
basket Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
bookings Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
catalogue Bug 42567: Remove C4::Koha::GetNormalizedEAN in favor of MetadataExtractor 2026-08-20 15:34:10 +00:00
cataloguing Bug 42512: Pass already checked/cleaned MARC::Record to Metadata Extractor 2026-07-16 10:54:18 +00:00
circ Bug 42930: Replace title with borrowertitle 2026-07-27 12:12:51 +00:00
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
debian Bug 43159: Restore localisation of PERL5LIB and KOHA_HOME 2026-07-31 13:40:33 +00:00
docs Bug 42726: Add 26.11 release team 2026-06-02 15:07:16 +00:00
erm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
etc Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
ill Bug 37762: Circulation: Hook to checkouts/checkins 2026-05-08 12:25:43 -06:00
installer Bug 30144: DBRev 26.06.00.017 2026-08-28 16:36:29 +00:00
koha-tmpl Bug 42605: Preserve acquisition preference string values 2026-08-28 16:36:32 +00:00
labels Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
lib Bug 41521: Silent perlcritic warnings 2026-03-24 09:55:54 +01:00
members Bug 43245: Redirect user if no email was provided 2026-08-14 12:09:30 +00:00
misc Bug 39769: Flush L1 cache in es_indexer_daemon.pl before each batch 2026-08-28 16:36:31 +00:00
offline_circ Bug 40492: Improvements to offline circ actions table 2026-07-28 14:32:44 +00:00
opac Bug 42634: Force JWT cookie deletion on self-checkout logout 2026-08-28 16:36:34 +00:00
patron_lists Bug 32176: Remove duplicated code to select patron from autocomplete 2025-10-31 15:26:25 -06:00
patroncards Bug 42747: (QA follow-up) Parameterize query, dedupe, and log rejections 2026-08-11 12:39:40 +00:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2025-11-21 08:41:52 -07:00
pos Bug 40445: (QA follow-up) Show cashup summary modal when completing from registers.pl 2026-07-27 12:12:41 +00:00
preservation Bug 35267: Apply preferences to preview and mailing 2026-04-17 09:18:06 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reports Bug 42736: Prevent SQL injection in reports/cat_issues_top.pl 2026-08-26 09:23:29 +00:00
reserve Bug 42999: Fix $valid_items flag contamination in reserve/request.pl 2026-07-16 17:05:21 +00:00
reviews Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serials Bug 43239: Preserve item item type if previousitemtype column is undefined 2026-08-12 15:49:49 +00:00
services Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sip2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
skel
…
suggestion Bug 42919: Retain suggestion form values when duplicate warning is shown 2026-07-16 17:05:13 +00:00
svc Bug 42084: (QA follow-up) Simplify 2026-06-03 12:08:17 +00:00
t Bug 42605: Add automated tests 2026-08-28 16:36:33 +00:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:48:24 -06:00
tools Bug 41105: (QA follow-up) DRY out gender label rendering 2026-08-14 12:09:18 +00:00
virtualshelves Bug 42567: Remove C4::Koha::GetNormalizedEAN in favor of MetadataExtractor 2026-08-20 15:34:10 +00:00
xt Bug 42714: RM follow-up: Fix tests 2026-08-13 11:28:40 +00:00
.codespell-ignore Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-03 16:09:05 +00:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 26355: Add a Vue island for the self-renewal modal 2026-05-01 09:30:00 -06:00
.htaccess
…
.mailmap Bug 40041: (follow-up) Fix periods and add Robert Fox 2025-12-05 09:29:04 -07:00
.nvmrc Bug 42353: Store the node version in .nvmrc 2026-04-15 09:14:53 -06:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL
…
Koha.pm Bug 30144: DBRev 26.06.00.017 2026-08-28 16:36:29 +00:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
MANIFEST.SKIP
…
Makefile.PL Bug 42886: Add missing rtl 2026-07-16 10:54:35 +00:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2025-10-09 14:58:41 -06:00
about.pl Bug 42453: Remove warning 2026-06-29 15:39:07 +00:00
app.psgi Bug 38365: Integrate CSP middleware into Plack apps 2026-03-16 11:57:12 +01:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cpanfile Bug 41717: Bump PDF::Reuse and PDF::Reuse::Barcode versions 2026-07-28 14:32:22 +00:00
cypress.config.ts Bug 42772: Cypress.env => cy.env 2026-07-20 12:45:01 +00:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
gulpfile.js Bug 42356: Silence Sass if-function deprecation warning 2026-04-17 09:18:15 -06:00
help.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
package.json Bug 43091: Clean the OPAC Vue dist directory in js:clean 2026-08-03 13:00:37 +00:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
rspack.config.js Bug 43091: Stop emitting staff-only Vue islands into the OPAC dist 2026-08-03 13:00:36 +00:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
yarn.lock Bug 42772: Adjust yarn.lock 2026-07-20 12:45:02 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo