From adee850f88dcedfd65a19d41a7fb4948d4c7eee3 Mon Sep 17 00:00:00 2001 From: Thomas Berezansky Date: Mon, 27 Feb 2012 09:03:51 -0500 Subject: [PATCH] Improve Firefox/XULRunner Support XULRunner/Firefox 4+ change the rules significantly, and to support them significant changes have to be made in Evergreen. This commit covers a number of things: 1 - Remote XUL Issues Later versions of XULRunner disable support for Remote XUL without using a whitelist entry, and whitelisting may stop working eventually as well. The solution here is the addition of a new protocol wrapper that allows Remote XUL to act like Local XUL. The wrapper is oils:// and acts like HTTPS for the most part. The "host" the client connects to is always "remote", however, and use of the wrapper has multiple effects. The first of these effects is the enabling of Remote XUL content, with as close to the Local XUL security level as I could manage. This means that nearly anything Local XUL can do, Remote XUL should be able to do too. The second of these effects is the disabling of JavaScript-visible cookies. XUL doesn't have cookies, and as such a side effect of the wrapper allowing remote content to appear to be local content is the lack of cookies. This does *not* affect server side visibility of cookies, however, so things like TPac can still see cookies. This required fixing a lot of places that were built to read data like authtokens out of cookies. The third of these effects is the "hiding" of the hostname for anything going through the wrapper. This prevents oils_persist from saving things correctly. I thus made oils_persist check for the wrapper and use the data stash to get the hostname instead. I suspect that we can get rid of the location.hostname check entirely at this point, but have not done so. The wrapper also sets a request header of OILS-Wrapper, value of 'true'. That allows the server to know that the request came through the wrapper. I used that ability to have TPac go into "Staff" mode when the wrapper is in use. This will enhance extension use, where the same authtoken will be seen by both the staff client and Firefox browsing. I willi also note that I rigged the wrapper to be easily adjusted for a second, hard-coded host for selfcheck use, using oils://selfcheck instead of oils://remote, that could be very easily turned into a minimal Firefox extension. That would enable the selfcheck code to have permission to work with printers and such without enablePrivilege (see next section). 2 - enablePrivilege Deprecation The enablePrivilege security model has been removed and no longer functions, and the staff client depended heavily upon it. The Remote XUL fix provided us with a way to fix the enablePrivilege issues, however. Because the Remote XUL has the Local XUL security context it doesn't need enablePrivilege anymore. However, because enablePrivilege no longer functions for those things *not* loaded through the wrapper some things had to be changed. For one, because if you are loaded through the wrapper you can't see cookies, and if you can see cookies you can't do "XUL" things, the "XUL" cookie has been removed. However, the wrapper can be detected by the protocol you are using, so I added protocol checking to the isXUL checks I know of. I am unsure about what, if anything, to do about the IAMXUL flag that is set by the browser code, though. For two, the JavaScript OPAC needs to be passed through the wrapper for some staff functions to work currently. This has the additional side effect of effectively forcing SSL mode for JSPac regardless of other settings. For three, I went ahead and removed all enablePrivilege calls I could find outside of the selfcheck code. As they no longer work they were just extra cruft. 3 - Component changes Component loading has changed significantly, and the easiest way to accommodate the changes was to re-write our components. The command line handler and force external components (the latter from another branch of mine) were simple enough, especially as they aren't interacted with by other code in the system (and as I wrote them I understood them anyway). While I was at it I made the force external component more extension-friendly. The data stash, however, was using a hack to accomplish what a singleton component could do more easily. That and I couldn't get it to function as it was. My solution was to re-write it as a singleton, removing the interface definition that was not needed. As I changed how it functioned so significantly I had to update all calls to it. In addition, I hid a window loading routine in the data stash component for easier loading of a *single* main Evergreen window from the Firefox overlays. 4 - Extension changes First off, Venkman, the DOM Inspector, and Chrome List are not guaranteed compatible with XULRunner anymore. As such, I have removed the out of date versions. Instead, I have added routines for loading Venkman and the DOM Inspector as Extensions. This keeps them easy to update to later versions, and makes us play much nicer when we are an extension. Also, now the buttons/menu items for loading these interfaces disable themselves if the extensions don't appear to be loaded. A side effect of that was that Windows installers compressed with zlib were unhappy. I switched to solid lzma, which in theory will get us smaller file sizes too. Secondly, Extensions have changed significantly in Firefox 4+, and Evergreen had to be adjusted to deal with some of the changes. I adjusted the overlay to take into account the new application menu, and I re-wrote the hotkey set loading routines to deal with the fact that extensions don't get extracted by default. 5 - Staff Client Build Process XULRunner has some changes that needed accounting for, such as a root level chrome.manifest being needed. Extension mode, as mentioned above, needed tweaks as well, and other issues were run into along the way. Both XULRunner and Firefox version support has been extended to 14.* and the base XULRunner download has been bumped to 14.0.1. In addition to the changes needed to support later XULRunner versions, I also included alternate application name support and support for OS-specific branding folders. Mainly because I ended up using all of them in testing, and decided to leave them in afterwards. 6 - Miscellaneous fixes MARC View was building a data URL and dumping it into an attribute without escaping it. Apparently this made XULRunner unhappy, so I added in escaping. 7 - Miscellaneous tweaks In addition to everything else, while I was running through my various tests I changed a few other things. I enabled the navigation buttons on the OPAC interface embedded in the patron overview for hold placement. With Remote XUL having the same security context as Local XUL they now work. I removed all non-SSL authtoken cookie assignments I could find, and flagged all the SSL ones I could find as being "secure" cookies. On the subject of cookies, I also told the logoff code to not erase every cookie, as those running in extension mode might dislike all cookies going away. I know that during my testing I disliked it, anyway. I removed the code that messes with the user agent. Extensions are basically not allowed to do that, and I don't think we need, or should rely on, a modified user agent elsewhere, so adding a check specifically for when we are not an extension didn't make a lot of sense to me. I also made it so that the automatic login command line options will work after a logoff (but they won't trigger a logoff) during a testing run where I was logging off, clearing cache, and logging in again repeatedly. To deal with CSS changes I changed most (but not all) popup elements to menupop elements. Popups in later XULRunners are transparent by default. Also for CSS changes, a menubar CSS entry in global.css was causing issues with menu visibility on Linux. Things look fine without it, so I went ahead and removed it outright. In the reporter I found that "class" was being used as a variable name, but that is a reserved keyword. I changed it to aClass. To make things easier for url_prefix use I made it so that the urls hash is checked by the url_prefix function. It looks for names up to the first of several characters: /, ?, |. If urls contains that name it is replaced into place. For | the | itself is removed in this process. Signed-off-by: Thomas Berezansky Signed-off-by: Dan Scott --- .../perlmods/lib/OpenILS/WWW/EGCatLoader.pm | 4 +- .../src/perlmods/lib/OpenILS/WWW/Proxy.pm | 3 +- .../perlmods/lib/OpenILS/WWW/Proxy/Authen.pm | 3 +- Open-ILS/src/templates/opac/parts/footer.tt2 | 6 +- Open-ILS/src/templates/opac/parts/header.tt2 | 2 +- Open-ILS/web/conify/global/actor/org_unit.js | 5 + .../web/conify/global/actor/org_unit_type.js | 5 + .../web/conify/global/config/copy_status.js | 5 + .../conify/global/config/marc_code_maps.js | 5 + .../web/conify/global/permission/grp_tree.js | 5 + .../web/conify/global/permission/perm_list.js | 5 + Open-ILS/web/js/dojo/openils/XUL.js | 36 +- .../js/dojo/openils/widget/TranslatorPopup.js | 8 +- Open-ILS/web/js/ui/base.js | 2 +- .../web/js/ui/default/acq/common/li_table.js | 4 +- .../web/js/ui/default/actor/user/register.js | 1 - .../web/js/ui/default/cat/authority/list.js | 1 - .../web/js/ui/default/serial/subscription.js | 2 +- .../subscription/caption_and_pattern.js | 5 +- .../web/js/ui/default/vandelay/vandelay.js | 1 - Open-ILS/web/opac/common/js/RemoteRequest.js | 9 +- Open-ILS/web/opac/common/js/opac_utils.js | 14 +- .../web/opac/extras/circ/alt_holds_print.html | 5 + Open-ILS/web/opac/skin/default/js/rdetail.js | 1 - Open-ILS/web/reports/oils_rpt.js | 4 +- Open-ILS/web/reports/xul/source-setup.js | 6 +- Open-ILS/web/reports/xul/template-config.js | 4 +- Open-ILS/web/reports/xul/template_builder.xul | 2 +- Open-ILS/xul/staff_client/Makefile.am | 60 +- Open-ILS/xul/staff_client/application.ini | 2 +- Open-ILS/xul/staff_client/chrome.manifest | 27 + .../xul/staff_client/chrome/chrome.manifest | 42 -- .../xul/staff_client/chrome/chrome_list.jar | Bin 37599 -> 0 bytes .../chrome/content/OpenILS/data.js | 31 +- .../chrome/content/OpenILS/global_util.js | 26 +- .../content/OpenILS/util_overlay_chrome.xul | 5 +- .../content/OpenILS/util_overlay_offline.xul | 5 +- .../chrome/content/admin/survey_wizard.xul | 1 - .../chrome/content/auth/controller.js | 4 +- .../chrome/content/auth/session.js | 19 +- .../staff_client/chrome/content/cat/opac.js | 67 +- .../staff_client/chrome/content/cat/opac.xul | 1 - .../chrome/content/circ/offline.js | 3 - .../chrome/content/circ/offline.xul | 1 - .../chrome/content/circ/offline_checkin.js | 2 - .../chrome/content/circ/offline_checkout.js | 2 - .../content/circ/offline_in_house_use.js | 2 - .../chrome/content/circ/offline_register.js | 2 - .../chrome/content/circ/offline_renew.js | 2 - .../chrome/content/firefox/overlay.xul | 27 +- .../chrome/content/main/constants.js | 250 +++---- .../staff_client/chrome/content/main/main.js | 158 +++-- .../staff_client/chrome/content/main/menu.js | 171 ++--- .../chrome/content/main/menu_frame.xul | 1 - .../chrome/content/main/menu_frame_menus.xul | 2 +- .../chrome/content/main/simple_auth.xul | 1 - .../chrome/content/util/browser.js | 18 - .../chrome/content/util/browser.xul | 8 +- .../chrome/content/util/clipboard.js | 3 - .../staff_client/chrome/content/util/deck.js | 2 - .../staff_client/chrome/content/util/error.js | 6 - .../chrome/content/util/fancy_prompt.xul | 1 - .../staff_client/chrome/content/util/file.js | 17 - .../chrome/content/util/fm_view.xul | 1 - .../staff_client/chrome/content/util/list.js | 2 - .../chrome/content/util/list_clipboard.xul | 1 - .../chrome/content/util/mozilla.js | 5 - .../chrome/content/util/network.js | 9 +- .../staff_client/chrome/content/util/print.js | 14 - .../chrome/content/util/rbrowser.xul | 8 +- .../staff_client/chrome/content/util/shell.js | 2 - .../staff_client/chrome/content/util/sound.js | 3 - .../chrome/content/util/widget_prompt.js | 1 - .../chrome/content/util/widgets.js | 4 - .../chrome/content/util/window.js | 20 +- .../chrome/content/util/xuledit.xul | 2 +- .../xul/staff_client/chrome/inspector.jar | Bin 698823 -> 0 bytes .../xul/staff_client/chrome/skin/global.css | 2 - Open-ILS/xul/staff_client/chrome/venkman.jar | Bin 871633 -> 0 bytes Open-ILS/xul/staff_client/components/clh.js | 357 ++++------ .../staff_client/components/forceexternal.js | 165 ++--- .../components/inspector-cmdline.js | 179 ----- .../staff_client/components/nsIOpenILS.idl | 6 - .../staff_client/components/nsIOpenILS.xpt | Bin 156 -> 0 bytes .../xul/staff_client/components/nsOpenILS.js | 100 ++- .../staff_client/components/oils_protocol.js | 64 ++ .../components/venkman-service.js | 619 ------------------ .../staff_client/external/dojo_template.js | 1 - .../xul/staff_client/external/template.js | 3 - .../xul/staff_client/external/template.xul | 3 +- Open-ILS/xul/staff_client/install.rdf | 4 +- .../xul/staff_client/server/admin/adminlib.js | 8 + .../server/admin/circ_age_to_lost.js | 1 - .../server/admin/copy_locations.js | 8 + .../do_not_auto_attempt_print_setting.js | 1 - .../server/admin/font_settings.xul | 3 - .../server/admin/hold_pull_list_classic.js | 1 - .../xul/staff_client/server/admin/index.xhtml | 2 +- .../server/admin/offline_manage_xacts.js | 27 +- .../server/admin/offline_manage_xacts.xul | 1 - .../server/admin/org_unit_settings.js | 5 + .../server/admin/patrons_due_refunds.js | 2 - .../server/admin/patrons_due_refunds.xul | 4 +- .../server/admin/printer_settings.html | 2 +- .../server/admin/printer_settings.js | 6 - .../server/admin/stat_cat_editor.js | 8 + .../xul/staff_client/server/admin/toolbar.js | 1 - .../server/admin/transit_list.xul | 5 +- .../staff_client/server/admin/upload_xacts.js | 3 +- .../xul/staff_client/server/admin/work_log.js | 1 - .../staff_client/server/admin/work_log.xul | 8 +- .../xul/staff_client/server/cat/bib_brief.js | 7 +- .../staff_client/server/cat/bibs_abreast.js | 5 +- .../staff_client/server/cat/bibs_abreast.xul | 2 +- .../staff_client/server/cat/copy_browser.js | 21 +- .../staff_client/server/cat/copy_browser.xul | 5 +- .../staff_client/server/cat/copy_buckets.xul | 1 - .../server/cat/copy_buckets_quick.xul | 1 - .../staff_client/server/cat/copy_editor.js | 3 - .../staff_client/server/cat/copy_notes.xul | 2 - .../staff_client/server/cat/copy_summary.xul | 1 - .../server/cat/manage_multi_home_items.js | 2 - .../server/cat/manage_multi_home_items.xul | 4 +- .../xul/staff_client/server/cat/marc_new.xul | 8 +- .../staff_client/server/cat/marc_view.html | 2 - .../xul/staff_client/server/cat/marc_view.xul | 5 +- .../xul/staff_client/server/cat/marcedit.js | 5 +- .../xul/staff_client/server/cat/marcedit.xul | 140 ++-- .../staff_client/server/cat/record_buckets.js | 12 +- .../server/cat/record_buckets.xul | 2 - .../server/cat/record_buckets_quick.xul | 1 - .../staff_client/server/cat/spine_labels.js | 3 - Open-ILS/xul/staff_client/server/cat/util.js | 23 +- .../server/cat/volume_buckets.xul | 1 - .../server/cat/volume_copy_creator.js | 7 +- .../server/cat/volume_copy_editor.js | 1 - .../server/cat/volume_copy_editor.xul | 4 +- .../server/cat/volume_copy_editor_horiz.xul | 4 +- .../staff_client/server/cat/volume_editor.js | 1 - Open-ILS/xul/staff_client/server/cat/z3950.js | 22 +- .../xul/staff_client/server/cat/z3950.xul | 3 +- .../server/circ/alternate_copy_summary.js | 1 - .../xul/staff_client/server/circ/checkin.xul | 1 - .../server/circ/checkin_overlay.xul | 4 +- .../xul/staff_client/server/circ/checkout.js | 3 +- .../xul/staff_client/server/circ/checkout.xul | 1 - .../staff_client/server/circ/circ_brief.xul | 1 - .../staff_client/server/circ/circ_summary.xul | 1 - .../staff_client/server/circ/copy_details.xul | 1 - .../staff_client/server/circ/copy_status.js | 14 +- .../staff_client/server/circ/copy_status.xul | 1 - .../server/circ/copy_status_overlay.xul | 10 +- .../staff_client/server/circ/in_house_use.xul | 1 - .../server/circ/missing_pieces.js | 1 - .../server/circ/pre_cat_fields.xul | 1 - .../server/circ/print_list_template_editor.js | 8 +- .../circ/print_list_template_editor.xul | 3 +- .../xul/staff_client/server/circ/renew.xul | 1 - .../server/circ/renew_overlay.xul | 4 +- Open-ILS/xul/staff_client/server/circ/util.js | 12 +- Open-ILS/xul/staff_client/server/index.xhtml | 11 +- .../xul/staff_client/server/main/data.xul | 14 +- .../server/main/gen_offline_widgets.xul | 5 - .../staff_client/server/main/simple_auth.xul | 1 - .../xul/staff_client/server/main/ws_info.xul | 3 - .../server/patron/barcode_entry.xul | 3 +- .../xul/staff_client/server/patron/bill2.js | 3 - .../xul/staff_client/server/patron/bill2.xul | 4 +- .../server/patron/bill_cc_info.xul | 1 - .../server/patron/bill_check_info.xul | 1 - .../server/patron/bill_details.js | 2 - .../server/patron/bill_history.js | 1 - .../staff_client/server/patron/bill_wizard.js | 1 - .../xul/staff_client/server/patron/display.js | 26 +- .../staff_client/server/patron/display.xul | 2 - .../server/patron/display_horiz.xul | 2 - .../server/patron/hold_details.js | 3 - .../xul/staff_client/server/patron/holds.js | 32 +- .../xul/staff_client/server/patron/holds.xul | 1 - .../server/patron/holds_overlay.xul | 6 +- .../staff_client/server/patron/info_group.js | 14 +- .../staff_client/server/patron/info_group.xul | 4 +- .../staff_client/server/patron/info_notes.xul | 2 - .../server/patron/info_stat_cats.xul | 1 - .../server/patron/info_surveys.xul | 1 - .../xul/staff_client/server/patron/items.js | 4 +- .../xul/staff_client/server/patron/items.xul | 1 - .../server/patron/items_overlay.xul | 8 +- .../staff_client/server/patron/place_hold.js | 2 - .../server/patron/search_form.xul | 2 - .../server/patron/search_form_horiz.xul | 2 - .../server/patron/search_result.xul | 1 - .../xul/staff_client/server/patron/staged.js | 4 +- .../xul/staff_client/server/patron/staged.xul | 4 +- .../server/patron/standing_penalties.js | 4 - .../server/patron/standing_penalties.xul | 4 +- .../xul/staff_client/server/patron/summary.js | 2 - .../staff_client/server/patron/summary.xul | 5 - .../server/patron/summary_overlay.xul | 4 +- .../server/patron/summary_overlay_horiz.xul | 8 +- .../server/patron/user_buckets.xul | 2 - .../xul/staff_client/server/patron/util.js | 4 +- .../server/serial/batch_receive.js | 12 +- .../staff_client/server/serial/editor_base.js | 1 - .../server/serial/manage_dists.js | 10 +- .../server/serial/manage_dists.xul | 5 +- .../server/serial/manage_items.js | 2 +- .../server/serial/manage_items.xul | 5 +- .../staff_client/server/serial/manage_subs.js | 8 +- .../server/serial/manage_subs.xul | 5 +- .../xul/staff_client/server/serial/notes.xul | 2 - .../server/serial/sbsum_editor.js | 1 - .../staff_client/server/serial/scap_editor.js | 4 +- .../server/serial/sdist_editor.js | 1 - .../staff_client/server/serial/select_aou.xul | 1 - .../server/serial/select_unit.xul | 1 - .../server/serial/serctrl_main.xul | 4 +- .../staff_client/server/serial/siss_editor.js | 1 - .../server/serial/sisum_editor.js | 1 - .../server/serial/sitem_editor.js | 1 - .../server/serial/sitem_editor.xul | 1 - .../server/serial/sssum_editor.js | 1 - .../staff_client/server/serial/sstr_editor.js | 1 - .../staff_client/server/serial/ssub_editor.js | 1 - .../server/skin/custom.js.example | 2 - Open-ILS/xul/staff_client/windowssetup.nsi | 3 + docs/RELEASE_NOTES_NEXT/new_xulrunner.txt | 60 ++ 227 files changed, 1192 insertions(+), 2308 deletions(-) create mode 100644 Open-ILS/xul/staff_client/chrome.manifest delete mode 100644 Open-ILS/xul/staff_client/chrome/chrome_list.jar delete mode 100644 Open-ILS/xul/staff_client/chrome/inspector.jar delete mode 100644 Open-ILS/xul/staff_client/chrome/venkman.jar delete mode 100644 Open-ILS/xul/staff_client/components/inspector-cmdline.js delete mode 100644 Open-ILS/xul/staff_client/components/nsIOpenILS.idl delete mode 100644 Open-ILS/xul/staff_client/components/nsIOpenILS.xpt create mode 100644 Open-ILS/xul/staff_client/components/oils_protocol.js delete mode 100644 Open-ILS/xul/staff_client/components/venkman-service.js create mode 100644 docs/RELEASE_NOTES_NEXT/new_xulrunner.txt diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm index 64903e990f..1f31081553 100644 --- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm +++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm @@ -246,7 +246,8 @@ sub load_common { $ctx->{full_path} = $ctx->{base_path} . $self->cgi->path_info; $ctx->{unparsed_uri} = $self->apache->unparsed_uri; $ctx->{opac_root} = $ctx->{base_path} . "/opac"; # absolute base url - $ctx->{is_staff} = 0; # Assume false, check for workstation id later. Was: ($self->apache->headers_in->get('User-Agent') =~ /oils_xulrunner/); + $ctx->{is_staff} = ($self->apache->headers_in->get('OILS-Wrapper') =~ /true/); + $ctx->{proto} = 'oils' if $ctx->{is_staff}; $ctx->{physical_loc} = $self->get_physical_loc; # capture some commonly accessed pages @@ -265,7 +266,6 @@ sub load_common { 'open-ils.actor', 'open-ils.actor.user.opac.vital_stats', $e->authtoken, $e->requestor->id); - $ctx->{is_staff} = 1 if $e->requestor->wsid; } else { diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm index c3eddbf91f..c9a85af4fa 100644 --- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm +++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm @@ -109,7 +109,8 @@ sub handler { -cookie=>$cgi->cookie( -name=>'ses', -value=>$auth_ses, - -path=>'/' + -path=>'/', + -secure=>1 ) ); return Apache2::Const::REDIRECT; diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm index d6ca65e12b..5bf6c1400c 100644 --- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm +++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm @@ -74,7 +74,8 @@ sub handler { $cookie = $cgi->cookie( -name=>'ses', -value=>$auth_ses, - -path=>'/' + -path=>'/', + -secure=>1 ); } } diff --git a/Open-ILS/src/templates/opac/parts/footer.tt2 b/Open-ILS/src/templates/opac/parts/footer.tt2 index 76c6b7a56d..236805526b 100644 --- a/Open-ILS/src/templates/opac/parts/footer.tt2 +++ b/Open-ILS/src/templates/opac/parts/footer.tt2 @@ -1,10 +1,6 @@ -[%- - USE CGI = CGI_utf8; - hostname = CGI.url({'-base' => 1}); --%]