Koha/koha-tmpl/intranet-tmpl/prog/js/pages/batchMod.js
Owen Leonard 59ff962caa Bug 26019: Koha should set SameSite attribute on cookies
This patch modifies the way Koha sets cookies so that the "sameSite"
attribute is explicitly set to "Lax." This option is chosen because it
is the value which is currently assumed by browsers when the sameSite
attribute is not set.

To test, apply the patch and restart services.

- Log in to the staff interface and open your browser's developer tools.
  - In Firefox, look for a "Storage" tab.
  - In Chrome, look for an "Application" tab.
- Under "Cookies," click the URL of the staff interface.
- You should see all the cookies which are set for that domain.
- The CGISESSID cookie should have sameSite set to "Lax."

- Go to Cataloging -> New record.
  - Check the "marcdocs" and "marctags" cookies.
- Switch to the Advanced MARC editor (you may need to enable
  theEnableAdvancedCatalogingEditor preference).
  - Check the "catalogue_editor" cookie.
- Add a new item to an existing bibliographic record.
  - Check the "LastCreatedItem" cookie which is set after you save the
    new item.
- Go to Authorities -> Authority search.
  - In authority search results, click "Merge" from the "Actions" menu
    next to one of the results..
    - Check the "auth_to_merge" cookie.
- Go to Administration -> MARC bibliographic framework
  - Choose "MARC structure" from the menu corresponding to one of the
    frameworks.
  - Check the "Display only used tags/subfields" checkbox.
    - Check the "marctagstructure_selectdisplay" cookie.
- Go to Circulation -> Check out to a patron with checkouts.
  - Check the "Always show checkouts immediately" checkbox.
    - Check the "issues-table-load-immediately-circulation" cookie.
- Go to Tools -> Patron clubs. You will need at least one active club
  with one or more patrons enrolled.
  - From the list of clubs, click Actions -> Search to hold.
    - Check the "holdforclub" cookie.
- Go to Tools -> Batch item modification and submit a batch of items.
  - Uncheck one or more checkboxes in the "Show/hide columns" area.
    - Check the "showColumns" cookie.
- View a patron -> Search to hold.
  - Check the 'holdfor' cookie.
- With WebBasedSelfCheck enabled, log in to the self-checkout page.
  - Check the "JWT" cookie.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2022-04-13 15:55:38 +02:00

163 lines
5.9 KiB
JavaScript

/* global dataTablesDefaults allColumns Cookies */
// Set expiration date for cookies
var date = new Date();
date.setTime(date.getTime() + (365 * 24 * 60 * 60 * 1000));
function guess_nb_cols() {
// This is a bit ugly, we are trying to know if there are checkboxes in the first column of the table
if ( $("#itemst tr:first th:first").html() == "" ) {
// First header is empty, it's a checkbox
return 3;
} else {
// First header is not empty, there are no checkboxes
return 2;
}
}
function hideColumns() {
var valCookie = Cookies.get("showColumns");
var nb_cols = guess_nb_cols();
if (valCookie) {
valCookie = valCookie.split("/");
$("#showall").prop("checked", false).parent().removeClass("selected");
for ( var i = 0; i < valCookie.length; i++ ) {
if (valCookie[i] !== '') {
var index = valCookie[i] - nb_cols;
$("#itemst td:nth-child(" + valCookie[i] + "),#itemst th:nth-child(" + valCookie[i] + ")").toggle();
$("#checkheader" + index).prop("checked", false).parent().removeClass("selected");
}
}
}
}
function hideColumn(num) {
$("#hideall,#showall").prop("checked", false).parent().removeClass("selected");
var nb_cols = guess_nb_cols();
var valCookie = Cookies.get("showColumns");
// set the index of the table column to hide
$("#" + num).parent().removeClass("selected");
var hide = Number(num.replace("checkheader", "")) + nb_cols;
// hide header and cells matching the index
$("#itemst td:nth-child(" + hide + "),#itemst th:nth-child(" + hide + ")").toggle();
// set or modify cookie with the hidden column's index
if (valCookie) {
valCookie = valCookie.split("/");
var found = false;
for ( var i = 0; i < valCookie.length; i++ ) {
if (hide == valCookie[i]) {
found = true;
break;
}
}
if (!found) {
valCookie.push(hide);
var cookieString = valCookie.join("/");
Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' });
}
} else {
Cookies.set("showColumns", hide, { expires: date, path: '/', sameSite: 'Lax' });
}
}
// Array Remove - By John Resig (MIT Licensed)
// http://ejohn.org/blog/javascript-array-remove/
Array.prototype.remove = function (from, to) {
var rest = this.slice((to || from) + 1 || this.length);
this.length = from < 0 ? this.length + from : from;
return this.push.apply(this, rest);
};
function showColumn(num) {
$("#hideall").prop("checked", false).parent().removeClass("selected");
$("#" + num).parent().addClass("selected");
var valCookie = Cookies.get("showColumns");
// set the index of the table column to hide
var nb_cols = guess_nb_cols();
var show = Number(num.replace("checkheader", "")) + nb_cols;
// hide header and cells matching the index
$("#itemst td:nth-child(" + show + "),#itemst th:nth-child(" + show + ")").toggle();
// set or modify cookie with the hidden column's index
if (valCookie) {
valCookie = valCookie.split("/");
var found = false;
for ( var i = 0; i < valCookie.length; i++ ) {
if (show == valCookie[i]) {
valCookie.remove(i);
found = true;
}
}
if (found) {
var cookieString = valCookie.join("/");
Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' });
}
}
}
function showAllColumns() {
var nb_cols = guess_nb_cols();
$("#selections input:checkbox").each(function () {
$(this).prop("checked", true);
});
$("#selections span").addClass("selected");
$("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().show();
Cookies.remove("showColumns", { path: '/' });
$("#hideall").prop("checked", false).parent().removeClass("selected");
}
function hideAllColumns() {
var nb_cols = guess_nb_cols();
$("#selections input:checkbox").each(function () {
$(this).prop("checked", false);
});
$("#selections span").removeClass("selected");
$("#itemst td:nth-child("+nb_cols+"),#itemst tr th:nth-child("+nb_cols+")").nextAll().hide();
$("#hideall").prop("checked", true).parent().addClass("selected");
var cookieString = allColumns.join("/");
Cookies.set("showColumns", cookieString, { expires: date, path: '/', sameSite: 'Lax' });
}
$(document).ready(function () {
hideColumns();
$("#itemst").dataTable($.extend(true, {}, dataTablesDefaults, {
"sDom": 't',
"aoColumnDefs": [
{ "aTargets": [0], "bSortable": false, "bSearchable": false },
{ "sType": "anti-the", "aTargets": ["anti-the"] }
],
"bPaginate": false,
}));
$("#selectallbutton").click(function (e) {
e.preventDefault();
$("#itemst input:checkbox").each(function () {
$(this).prop("checked", true);
});
});
$("#clearallbutton").click(function (e) {
e.preventDefault();
$("#itemst input:checkbox").each(function () {
$(this).prop("checked", false);
});
});
$("#clearonloanbutton").click(function () {
$("#itemst input[name='itemnumber'][data-is-onloan='1']").each(function () {
$(this).prop('checked', false);
});
return false;
});
$("#selections input").change(function (e) {
var num = $(this).attr("id");
if (num == 'showall') {
showAllColumns();
e.stopPropagation();
} else if (num == 'hideall') {
hideAllColumns();
e.stopPropagation();
} else {
if ($(this).prop("checked")) {
showColumn(num);
} else {
hideColumn(num);
}
}
});
});