From 237c1483ddf22babb4f1bfd4dfa3e7120c2d8cd9 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 5 Nov 2015 13:24:51 +0000
Subject: [PATCH] Bug 14743: addorder.pl redirect problems under plack behind
 apache 2.4.10

I can't quite figure this out. When I run CGI version of Koha, I see following response (recorded using tcpdump):

HTTP/1.1 302 Found
Date: Thu, 27 Aug 2015 13:28:41 GMT
Server: Apache/2.4.10 (Debian)
Location: /cgi-bin/koha/acqui/basket.pl?basketno=5610
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/x-perl

However, when running behind apache 2.4.10 on Debian wheezy I see chunked response:

HTTP/1.1 302 Found
Date: Thu, 27 Aug 2015 13:21:28 GMT
Server: Apache/2.4.10 (Debian)
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/x-perl

60
Transfer-Encoding: chunked
Date: Thu, 27 Aug 2015 13:21:28 GMT
Connection: keep-alive

0

0

This response doesn't work in firefox (where it reports page not found) nor in chrome (where it returns lines below 60 on screen).

In the template the hidden input 'basketno' is listed twice. What the cgi script reads in the parameter, what is does is concat the values of the multiple basketno instances together createing what is likely an invalid basketno. For reasons beyond my understanding this is what triggers this error!

Test Plan:
1) Using plack, add an order to a basket from an external source
2) Note the error
3) Apply this patch
4) Add an order to a basket from an external source
5) Note you get no error!

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
index b0cc08ce4b..7638f0289e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
@@ -275,7 +275,6 @@ $(document).ready(function()
                         </li>
                       [% END %]
                     </ul>
-                    <input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
                     <input type="hidden" id="users_ids" name="users_ids" value="[% users_ids %]" />
                     <input type="hidden" id="op" name="op" value="mod_users" />
                     <input type="button" id="add_user" onclick="UserSearchPopup();" value="Add user" />
-- 
2.39.5