Koha/koha-tmpl/intranet-tmpl/prog/js/members-menu.js
Owen Leonard 59ff962caa Bug 26019: Koha should set SameSite attribute on cookies
This patch modifies the way Koha sets cookies so that the "sameSite"
attribute is explicitly set to "Lax." This option is chosen because it
is the value which is currently assumed by browsers when the sameSite
attribute is not set.

To test, apply the patch and restart services.

- Log in to the staff interface and open your browser's developer tools.
  - In Firefox, look for a "Storage" tab.
  - In Chrome, look for an "Application" tab.
- Under "Cookies," click the URL of the staff interface.
- You should see all the cookies which are set for that domain.
- The CGISESSID cookie should have sameSite set to "Lax."

- Go to Cataloging -> New record.
  - Check the "marcdocs" and "marctags" cookies.
- Switch to the Advanced MARC editor (you may need to enable
  theEnableAdvancedCatalogingEditor preference).
  - Check the "catalogue_editor" cookie.
- Add a new item to an existing bibliographic record.
  - Check the "LastCreatedItem" cookie which is set after you save the
    new item.
- Go to Authorities -> Authority search.
  - In authority search results, click "Merge" from the "Actions" menu
    next to one of the results..
    - Check the "auth_to_merge" cookie.
- Go to Administration -> MARC bibliographic framework
  - Choose "MARC structure" from the menu corresponding to one of the
    frameworks.
  - Check the "Display only used tags/subfields" checkbox.
    - Check the "marctagstructure_selectdisplay" cookie.
- Go to Circulation -> Check out to a patron with checkouts.
  - Check the "Always show checkouts immediately" checkbox.
    - Check the "issues-table-load-immediately-circulation" cookie.
- Go to Tools -> Patron clubs. You will need at least one active club
  with one or more patrons enrolled.
  - From the list of clubs, click Actions -> Search to hold.
    - Check the "holdforclub" cookie.
- Go to Tools -> Batch item modification and submit a batch of items.
  - Uncheck one or more checkboxes in the "Show/hide columns" area.
    - Check the "showColumns" cookie.
- View a patron -> Search to hold.
  - Check the 'holdfor' cookie.
- With WebBasedSelfCheck enabled, log in to the self-checkout page.
  - Check the "JWT" cookie.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2022-04-13 15:55:38 +02:00

173 lines
6.4 KiB
JavaScript

/* global borrowernumber advsearch dateformat __ CAN_user_borrowers_delete_borrowers CAN_user_borrowers_edit_borrowers number_of_adult_categories destination Sticky Cookies*/
$(document).ready(function(){
$("#filteraction_off, #filteraction_on").on('click', function(e) {
e.preventDefault();
$('#filters').toggle();
$('.filteraction').toggle();
if (typeof Sticky !== "undefined" && typeof hcSticky === "function") {
Sticky.hcSticky('update');
}
});
if( advsearch ){
$("#filteraction_on").toggle();
$("#filters").show();
} else {
$("#filteraction_off").toggle();
}
searchfield_date_tooltip("");
searchfield_date_tooltip('_filter');
$("#searchfieldstype").change(function() {
searchfield_date_tooltip("");
});
$("#searchfieldstype_filter").change(function() {
searchfield_date_tooltip('_filter');
});
if( CAN_user_borrowers_delete_borrowers ){
$("#deletepatron").click(function(){
window.location='/cgi-bin/koha/members/deletemem.pl?member=' + borrowernumber;
});
}
if( CAN_user_borrowers_edit_borrowers ){
$("#renewpatron").click(function(){
confirm_reregistration();
$(".btn-group").removeClass("open");
return false;
});
$("#updatechild").click(function(e){
if( $(this).data("toggle") == "tooltip"){ // Disabled menu option has tooltip attribute
e.preventDefault();
} else {
update_child();
$(".btn-group").removeClass("open");
}
});
}
$("#updatechild, #patronflags, #renewpatron, #deletepatron, #exportbarcodes").tooltip();
$("#exportcheckins").click(function(){
export_barcodes();
$(".btn-group").removeClass("open");
return false;
});
$("#printsummary").click(function(){
printx_window("page");
$(".btn-group").removeClass("open");
return false;
});
$("#printslip").click(function(){
printx_window("slip");
$(".btn-group").removeClass("open");
return false;
});
$("#printquickslip").click(function(){
printx_window("qslip");
$(".btn-group").removeClass("open");
return false;
});
$("#print_overdues").click(function(){
window.open("/cgi-bin/koha/members/print_overdues.pl?borrowernumber=" + borrowernumber, "printwindow");
$(".btn-group").removeClass("open");
return false;
});
$("#printcheckinslip").click(function(){
printx_window("checkinslip");
$(".btn-group").removeClass("open");
return false;
});
$("#printclearscreen").click(function(){
printx_window("slip");
window.location.replace("/cgi-bin/koha/circ/circulation.pl");
});
$("#searchtohold").click(function(){
searchToHold();
return false;
});
$("#select_patron_messages").on("change",function(){
$("#borrower_message").val( $(this).val() );
});
$("#patronImageEdit").on("shown.bs.modal", function(){
startup();
});
$(".edit-patronimage").on("click", function(e){
e.preventDefault();
var borrowernumber = $(this).data("borrowernumber");
var cardnumber = $(this).data("cardnumber");
var modalTitle = $(this).attr("title");
$("#patronImageEdit .modal-title").text(modalTitle);
$("#patronImageEdit").modal("show");
$("#patronImageEdit").on("hidden.bs.modal", function(){
/* Stop using the user's camera when modal is closed */
let viewfinder = document.getElementById("viewfinder");
if( viewfinder.srcObject ){
viewfinder.srcObject.getTracks().forEach( track => {
if( track.readyState == 'live' && track.kind === 'video'){
track.stop();
}
});
}
});
});
});
function searchfield_date_tooltip(filter) {
var field = "#searchmember" + filter;
var type = "#searchfieldstype" + filter;
if ( $(type).val() == 'dateofbirth' ) {
var MSG_DATE_FORMAT = "";
if( dateformat == 'us' ){
MSG_DATE_FORMAT = __("Dates of birth should be entered in the format 'MM/DD/YYYY'");
} else if( dateformat == 'iso' ){
MSG_DATE_FORMAT = __("Dates of birth should be entered in the format 'YYYY-MM-DD'");
} else if( dateformat == 'metric' ){
MSG_DATE_FORMAT = __("Dates of birth should be entered in the format 'DD/MM/YYYY'");
} else if( dateformat == 'dmydot' ){
MSG_DATE_FORMAT = __("Dates of birth should be entered in the format 'DD.MM.YYYY'");
}
$(field).attr("title", MSG_DATE_FORMAT).tooltip('show');
} else {
$(field).tooltip('destroy');
}
}
function confirm_updatechild() {
var is_confirmed = window.confirm( __("Are you sure you want to update this child to an Adult category? This cannot be undone.") );
if (is_confirmed) {
window.location='/cgi-bin/koha/members/update-child.pl?op=update&borrowernumber=' + borrowernumber;
}
}
function update_child() {
if( number_of_adult_categories > 1 ){
window.open('/cgi-bin/koha/members/update-child.pl?op=multi&borrowernumber=' + borrowernumber,'UpdateChild','width=400,height=300,toolbar=no,scrollbars=yes,resizable=yes');
} else {
confirm_updatechild();
}
}
function confirm_reregistration() {
var is_confirmed = window.confirm( __("Are you sure you want to renew this patron's registration?") );
if (is_confirmed) {
window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=' + borrowernumber + '&amp;destination=' + destination + '&amp;reregistration=y';
}
}
function export_barcodes() {
window.open('/cgi-bin/koha/members/readingrec.pl?borrowernumber=' + borrowernumber + '&amp;op=export_barcodes');
}
var slip_re = /slip/;
function printx_window(print_type) {
var handler = print_type.match(slip_re) ? "printslip" : "summary-print";
window.open("/cgi-bin/koha/members/" + handler + ".pl?borrowernumber=" + borrowernumber + "&amp;print=" + print_type, "printwindow");
return false;
}
function searchToHold(){
var date = new Date();
date.setTime(date.getTime() + (10 * 60 * 1000));
Cookies.set("holdfor", borrowernumber, { path: "/", expires: date, sameSite: 'Lax' });
location.href="/cgi-bin/koha/catalogue/search.pl";
}