https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43805
Bug ID: 43805
Summary: Logging back in after a session timeout 404s on Vue
pages served through a RewriteRule (record_sources,
circulation_triggers)
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Architecture, internals, and plumbing
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Target Milestone: ---
Staff interface pages that are served through a RewriteRule of the form
RewriteRule ^/cgi-bin/koha/admin/record_sources(.*)?$
/cgi-bin/koha/admin/record_sources.pl$1 [PT]
(etc/koha-httpd.conf and debian/templates/apache-shared-intranet.conf; the same
shape is used for admin/circulation_triggers) cannot be logged back in to after
the session times out.
The pattern also matches the script's own name, so a request for
record_sources.pl is rewritten to record_sources.pl.pl and returns 404. When
the login form is shown on such a page, its action is the script name
(/cgi-bin/koha/admin/record_sources.pl). Submitting it therefore 404s, no
session is created, and the user is stuck on an error page until they log in
through another page (for example mainpage.pl) and navigate back.
To reproduce (main, 26.06.00.035, in KTD):
1. Log out (or let the session expire).
2. Open /cgi-bin/koha/admin/record_sources. The login page is shown; its form
action is /cgi-bin/koha/admin/record_sources.pl.
3. Enter valid credentials and submit.
Expected: you are logged in and see the record sources page.
Actual: "Error 404 > Koha". No session is created.
Evidence with curl (cookie jar, valid csrf_token taken from the login page):
- POST to the form action /cgi-bin/koha/admin/record_sources.pl -> 404
- POST of the same fields to /cgi-bin/koha/admin/record_sources -> 200
GET /cgi-bin/koha/admin/record_sources.pl and
/cgi-bin/koha/admin/circulation_triggers.pl also return 404.
Not affected: acquisition/vendors, whose rule maps acquisition/vendors to
acqui/vendors.pl, so acqui/vendors.pl is reachable (200).
Found while building a new Vue page under Cataloguing (bug 30800), which copies
the same rule and so has the same problem.
Possible directions (not verified):
- Guard the rules so the script's own name is not rewritten, as is already done
for preservation in the same file:
RewriteCond %{REQUEST_URI} !^/cgi-bin/koha/preservation/.*.pl$
A similar RewriteCond for each of these pages would let the .pl URL reach the
script. The Vue router base paths are the extensionless URLs, so it needs
checking what the app does when it is loaded on the .pl URL after login.
- Or have the login form post back to the URL the user actually requested
instead of the script name when the request was rewritten.
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
