Apache update breaks booking UI

[Jeff Davis]

After applying a recent Apache update, attempts to reach the bookings UI in the web client started giving a 404 with "The requested URL /eg/eg/booking/reservation was not found on this server." in the iframe.

On Ubuntu 16.04, upgrading Apache to 2.4.18-2ubuntu3.10 produces the problem, and downgrading to 2.4.18-2ubuntu3 makes it go away. It appears that the Apache fix for CVE-2019-0220 is the culprit. There are other versions of that fix for Ubuntu 14.04, 18.04, and 18.10, so the same problem may exist in those environments (I haven't tested them).

The issue appears to be with how booking URLs are constructed -- they include a hard-coded double-slash which is now treated differently by Apache. I'll share a branch with a proposed fix shortly.

Thanks to Jeff Godin for narrowing down the cause of this issue.

[Jeff Davis (jdavis-sitka)]

Working branch user/jeffdavis/lp1823387-booking-url-double-slash-apache has a potential fix:

https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/jeffdavis/lp1823387-booking-url-double-slash-apache

Based on some light testing, this appears to work on both current and downgraded versions of Apache (at least on Ubuntu 16.04). It should be more rigorously tested before being committed.

[Jane Sandberg (sandbergja)]

Nice job tracking down this issue, Jeff and Jeff. This fix works for me; signoff branch here: user/sandbergja/lp1823387-booking-url-double-slash-apache

[Galen Charlton (gmc)]

Pushed to master, rel_3_3, rel_3_2, and rel_3_1. Thanks, Jeff, Jeff, and Jane!