gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Galen Charlton 52e0b599fd Bug 10016: force zero browser-side caching of SCO pages 
This patch makes the web-based self-check module pages
specify that no browser (or proxy caching) occur at all.
This prevents a security issue where letting the SCO session time out,
then hitting the back button allowed one to view the previous
patron's session.

This patch adds an optional fifth parameter to output_with_http_headers(),
and output_html_with_http_headers(), a hashref for miscellaneous
options.  One key is defined at the moment: force_no_caching, which if
if present and set to a true value, sets HTTP headers to specify no
browser caching of the page at all.

To test:

[1] Start a web-based self-check session and optionally perform
    some transactions.
[2] Allow the session to time out (it may be helpful to set
    SelfCheckTimeout to a low value such as 10 seconds).
[3] Hit the back button.  You should not see the previous patron's
    self-check session.
[4] Verify that prove -v t/Output.t passes.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 7b165794cd)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
 		2013-11-20 10:57:39 -03:00
..
errors Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
rss adding file just for creating the rss directory 2007-08-02 08:50:43 +00:00
sco Bug 10016: force zero browser-side caching of SCO pages 2013-11-20 10:57:39 -03:00
svc Bug 9587 : Handling mismatched emails better 2013-02-24 10:15:56 -05:00
ilsdi.pl Bug 10549: (follow-up) make sure ILS-DI GetAvailability response is emitted as UTF-8 2013-08-13 13:38:13 -03:00
maintenance.pl Bug 7853 - opac-maintanance.pl should correctly redirect back to opac-main.pl, if no updates are outstanding 2013-04-07 13:34:12 -04:00
oai.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-ISBDdetail.pl Bug 9504: URL escape in OPAC more searches 2013-03-20 08:36:44 -04:00
opac-MARCdetail.pl Bug 9504: URL escape in OPAC more searches 2013-03-20 08:36:44 -04:00
opac-account.pl Bug 4330 : Fixing FSF address and copyright statements 2012-05-28 17:53:46 +02:00
opac-addbybiblionumber.pl Bug 5894: Display all titles when confirming copy of items from cart to list 2013-07-15 20:21:39 -03:00
opac-alert-subscribe.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-authorities-home.pl Bug 9132: Paging through OPAC authority search results does not work 2012-11-28 08:13:18 -05:00
opac-authoritiesdetail.pl Bug 8981 follow-up: case 2012-11-29 22:07:29 -05:00
opac-basket.pl Bug 10026 - OPAC cart not showing location anymore 2013-04-23 08:44:11 -04:00
opac-browser.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-changelanguage.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-detail.pl Bug 10704: make OPAC highlighting work across previous/next travel 2013-09-13 10:58:16 -03:00
opac-downloadcart.pl bug 5579 : Fixes several exports to embed items 2011-04-19 22:35:15 +12:00
opac-downloadshelf.pl Bug 7788: [SIGNED-OFF] Remove two unused calls to GetShelf 2012-05-22 12:06:25 +02:00
opac-export.pl Bug 3652: close XSS vulnerabilities in opac-export 2012-10-24 15:40:18 +02:00
opac-ics.pl Bug 5549 : GetPendingIssues now returns DateTime objects 2012-03-20 12:33:37 +13:00
opac-image.pl Bug 8255: allow local cover images to be cached 2012-06-25 18:12:29 +02:00
opac-imageviewer.pl Bug 4321: clean C4::Biblio::GetBiblio and uses 2012-09-18 12:11:54 +02:00
opac-main.pl Bug 9395: Problem with callnumber and standard number searches 2013-02-15 18:30:15 -05:00
opac-memberentry.pl Bug 10204 - Patron image no longer appears in the OPAC 2013-05-08 09:47:46 -04:00
opac-messaging.pl Talking Tech Support - Phase I 2012-06-10 17:46:52 +02:00
opac-modrequest-suspend.pl Bug 7641: Suspend Reserves 2012-03-29 14:37:49 +02:00
opac-modrequest.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-mymessages.pl Bug 4330 : Fixing FSF address and copyright statements 2012-05-28 17:53:46 +02:00
opac-passwd.pl Bug 8515 - OPAC password change does not obey OpacPasswordChange 2012-11-25 18:30:14 -05:00
opac-patron-image.pl Bug 10201 - Old OPAC patron update system should be removed 2013-05-12 09:54:18 -04:00
opac-privacy.pl Bug 6506: When AnonymousPatron not set, deletion of issue history silently failed. 2013-05-01 08:44:27 -04:00
opac-ratings-ajax.pl Bug 8315 - fix 'C4::Output 3.02' errors in Koha 2012-06-29 11:59:13 +02:00
opac-ratings.pl Bug 5668 - Star ratings in the opac 2012-04-10 14:40:49 +02:00
opac-readingrecord.pl Bug 8017 reduce manipulation of GetAllIssues return 2012-09-13 18:51:45 +02:00
opac-registration-verify.pl Bug 7067 - QA Followup - Fix error when confirming via email 2012-12-14 08:09:02 -05:00
opac-renew.pl Bug 7551 : Can only renew for the user you are logged in as now 2012-02-17 09:12:21 +01:00
opac-reserve.pl Bug 10272: make CheckReserves respect ReservesControlBranch 2013-10-08 10:53:50 -03:00
opac-review.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-search-history.pl do some validation of the KohaOpacRecentSearches cookie 2013-07-28 10:41:38 -03:00
opac-search.pl Bug 10515: make behavior of library category fetchers consistent with other fetchers 2013-08-13 13:31:49 -03:00
opac-sendbasket.pl Bug 8626: Fix encoding in cart emails for use of quoted-printable 2012-08-29 18:14:32 +02:00
opac-sendshelf.pl Bug 3651 Follow-up, Require patron login to send shelves and baskets 2012-01-06 15:57:57 +01:00
opac-serial-issues.pl Bug 6195 : Opac user should not have serial manage tab 2011-04-19 13:29:01 +12:00
opac-shelves.pl Bug 7310: Code changes for Improving list permissions 2012-03-21 16:46:40 +01:00
opac-showmarc.pl Bug 9570 - view plain not working in ccsr 2013-03-07 09:33:57 -05:00
opac-showreviews.pl Bug 6679 :[SIGNED-OFF] Fixing some perlcritic violations in the opac 2012-04-10 13:45:00 +02:00
opac-suggestions.pl Bug 9457 - Followup - Ordering branches should be case independent (2) 2013-03-20 15:36:19 -04:00
opac-tags.pl bug 9401: remove direct reads of CGISESSID cookie by JavaScript 2013-02-01 11:05:35 -05:00
opac-tags_subject.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-topissues.pl Bug 10588: improve selection of default branch for OPAC popular items pag 2013-09-13 15:28:04 -03:00
opac-user.pl Bug 10672 - Add subtitle to display of checkouts, overdues, and holds on the patron summary 2013-10-08 10:42:30 -03:00
search.pl Bug 8233 : SearchEngine: Add a Koha::SearchEngine module 2012-07-06 16:51:58 +02:00
tracklinks.pl Bug 8917 : Shifting db dependent code to a module 2013-03-07 11:14:25 -05:00
unapi Bug 10085: unapi does not function under Plack 2013-04-23 08:34:05 -04:00