Number/Carrier Info left in SMS call number field when navigating back

Bug #1316788 reported by Geoff Sams on 2014-05-06
This bug affects 5 people
Affects Status Importance Assigned to Milestone

Bug Description

Evergreen 2.3.5
OpenSRF 2.1.2
Postgres 9.1
Ubuntu 12.04 LTS

Important Factor: We do not require patrons to log in to send SMS Call Number information.

When a patron sends Call Number information via the SMS feature, if you then hit back, the information is still present in the fields. This would allow other patrons to see both carrier and phone number information for other patrons if they were to press the back button.

I posted to IRC in order to check if a more recent version exhibited this issue and was told that 2.5 is showing this behavior as well by Kathy Lussier. (THanks for that!)

I didn't want to post the bug if there wasn't a more recent version involved.

Kathy Lussier (klussier) wrote :

We had a similar problem reported in that was fixed by adding a no-cache header for pages that required authentication. Since there are several sites that do not require authentication to send an SMS call number, the fix from that bug doesn't work here.

Changed in evergreen:
status: New → Confirmed
importance: Undecided → Medium
Michele Morgan (mmorgan) wrote :

This affects our consortium as well, we also do not require authentication to send a call number via SMS

Mike Rylander (mrylander) wrote :

This can be fixed with a little javascript attached to the form to clear it after submitting. It's not perfect (NoScript, etc, can defeat it) but for public terminals it should suffice since the JS environment is controlled there.

Here's an example:

Elaine Hardy (ehardy) on 2019-03-07
tags: added: patron privacy
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers