search

znuny / Znuny

Znuny/Znuny LTS is a fork of the ((OTRS)) Community Edition, one of the most flexible web-based ticketing systems used for Customer Service, Help Desk, IT Service Management.
https://www.znuny.org
GNU General Public License v3.0
332 stars 82 forks source link

Bug - Javascript error in customer TicketZoom #560

Open afleury88 opened 2 months ago

afleury88 commented 2 months ago

Environment

Expected behavior

The customer user should be able to see the full article written by an agent.

Actual behavior

In place of the detailed article there is a javascript error (I put the sreenshots to better understanding)

How to reproduce

Steps to reproduce the behavior:

  1. Go to localhost/znuny/customer.pl
  2. Click on the first ticket
  3. See error

Additional information

Using the firefox console I saw an error about the Iframe, saying it is undefined (you can see that on the second screenshot). I didn't touch these files, I only modified the Config.pm

I hope I gave enough informations. If not tell me and I will do my possible to give you the informations needed.

Thank you for your time :)

Screenshots

InkedCapture d’écran du 2024-04-30 14-10-35_LI

Capture d’écran du 2024-04-30 15-41-01

rkaldung commented 2 months ago

@afleury88 I can reproduce the error in the JavaScript console. I'm wondering about the login screen in the iframe. Is there anything non-default with the Znuny installation or the browser?

afleury88 commented 2 months ago

Hello, No, everything is default except for the logo ^^ We tried also with chromium and there is the same issue. For the record, I rolled back to Znuny 6.5 LTS (because we need the customer interface) and it works just fine. But I must mention there is a WAF working as a reverse proxy in front of the web app. Thank you for your help :)

rkaldung commented 2 months ago

@afleury88 Any change to bypass the WAF to see if this might causing the issue?

afleury88 commented 2 months ago

@rkaldung I just tried without passing through the WAF (direct between my computer and the web server) and there is the same issue. So the WAF is not in cause ^^

iali9906 commented 2 months ago

hi @afleury88 it had happened to me too, after contacting the developers on discord it turned out that it is not bug, but wrong conf:

your FQDN and your HTTPType don't match/match the called ones. Then the cookie cannot be set and the Session URL is used, which is just a bad fallback. One of the two does not match the real world httptype or fqdn if you connect via https, then https should also be the httptype

see SysConfig -> HttpType and SysConfig -> FQDN

afleury88 commented 1 month ago

hello @iali9906 Thanks for your help but unfortunately this isn't the problem.

The httptype was already set to https and after correcting the fqdn it didn't change anything about my issue :/

afleury88 commented 1 month ago

Hello everyone,

I just found what was the "config setting" which was getting me in trouble. It was the SessionUseCookie when activated. When I deactivated it there was no issue anymore. BUT by doing this the cookie of the session is now visible in the URL, which is a HUGE problem in terms of security.

PS : my web server is configured to prevent those things but it seems that ZNUNY is not willing to let it be.

Any idea how I could correct this ?

Thanks for your help :)

mo-azfar commented 1 month ago

Hello everyone,

I just found what was the "config setting" which was getting me in trouble. It was the SessionUseCookie when activated. When I deactivated it there was no issue anymore. BUT by doing this the cookie of the session is now visible in the URL, which is a HUGE problem in terms of security.

PS : my web server is configured to prevent those things but it seems that ZNUNY is not willing to let it be.

Any idea how I could correct this ?

Thanks for your help :)

For the SessionCookie,

Did you changed the ScriptAlias value? If you changed that, make sure also change it at $HOME/scripts/apache2-httpd.include.conf (with the expectation you already symlink it to apache config as well)

afleury88 commented 1 month ago

Hello @mo-azfar,

Actually I changed the ScriptAlias value at $HOME/scripts/apache2-httpd.include.conf and everywhere else except in the SysConfig GUI. So when I did that everything was back to normal.

Thanks everyone for your time and your help.

mo-azfar commented 1 month ago

Hello @mo-azfar,

Actually I changed the ScriptAlias value at $HOME/scripts/apache2-httpd.include.conf and everywhere else except in the SysConfig GUI. So when I did that everything was back to normal.

Thanks everyone for your time and your help.

Glad to hear that. However i would not close the issue yet as the JS error still there in console log event though didn't impact customer user experience (at least)

NiklasSchmitt commented 2 weeks ago

I can confirm that this reported javascript error IFrame is undefined still exists in Znuny 7.0.18.

Internal issue: 905