From 96e65a5f26c279f92483af066de4967a3ca7acf5 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 19 Jul 2017 13:02:01 -0300 Subject: [PATCH] Bug 18956: Password recovery - Do not disclose email if not given If a patron has started the password recovery process and another user enter the same login (or cardnumber), without a email address, the screen will display the email address of the account. Test plan: Given an account with login: koha password: whatever email: koha@k-c.org Enable the pref OpacResetPassword At the OPAC, ask for another password: "Forgot your password?" link Enter the correct login/email Assume you are somebody else and retry the process, but do not fill the email field. => Without this patch the email will be displayed on the screen => With this patch applied you will get "No account was found with the provided information." QA: You will need to understand the condition affected by this patch. Why was it there? Are we sure we do not introduce a regression with this patch? --- opac/opac-password-recovery.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl index f4c5e2bd23..d05a78c5ce 100755 --- a/opac/opac-password-recovery.pl +++ b/opac/opac-password-recovery.pl @@ -93,10 +93,10 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { $errNoBorrowerFound = 1; } -# If we dont have an email yet. Get one of the borrower's email or raise an error. - elsif ( !$email && !( $email = $firstNonEmptyEmail ) ) { +# No email has been entered, no recovery possible + elsif ( !$email ) { $hasError = 1; - $errNoBorrowerEmail = 1; + $errNoBorrowerFound = 1; } # Check if a password reset already issued for this borrower AND we are not asking for a new email -- 2.11.0