from commit 6fba85d23bf419516111ff959bb5ab7c67ee6414 Bug 29924: Avoid leaking information on wrong credentials This removed passing the password_has_expired info to the template - so we never get the notice or show the reset link
Created attachment 139249 [details] [review] Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration
Created attachment 139297 [details] [review] Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Created attachment 139302 [details] [review] Bug 31382: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 139303 [details] [review] Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Pushed to master for 22.11. Nice work everyone, thanks!
Backported to 22.05.x for 22.05.06
depends on password expiration feature not released in 21.11. no need to backport that one for 21.11.x I guess.