If you create a patron and don't set a password koha will fill the password field. But there's no hint on creation that this will happen, nor indication what password you will get. There should be a message (maybe via HTML 'label' or 'title') stating you will get a default password anyway and also saying which one will be. Maybe something like: "If you don't supply a password, system will fill with <this_default_password>" Also this information should be visibly highlighted, and a status flag should be set to indicate that and warn the patron to change it as soon as possible. Default password should be a system preference and it should be possible to set different ones for different libraries. Summary: - hint with a visible message about the automatic password filling - show default password in page (creation and modification), it will be know for everbody anyway - allow for different default passwords per library in system preferences
The database is actually empty - there is no password generated (that was my understanding) the *** you see is just always there - it's part of the template. Someone else can confirm for me before I close this bug - or change the title to 'password needs template edits' Nicole
I don't really like the idea of a default password. People tend to keep passwords like that and never change them. I makes it much easier to hack patron accounts. When you change a password Koha can already generate a new random password in the length specified in the sys prefs. I would like to see Koha generating a password like this one upon saving a patron with an empty password field. Koha can send out this password as a mail to the patron, if the library wants to do this. We already can do this with manually entered passwords. Ideal would be a to create a one time password and force the patron to change it when he logs into the OPAC for the first time. Perhaps these one time passwords should even expire after a given time or be validated by a mail to the patrons email account.
(In reply to comment #1) > The database is actually empty - there is no password generated (that was my > understanding) the *** you see is just always there - it's part of the > template. > > Someone else can confirm for me before I close this bug - or change the title > to 'password needs template edits' > > Nicole Maybe I'm looking in the wrong place, I just created a patron named 'haspassword', give him no password in opac login group and it shows this on DB: mysql> select password from borrowers where surname = 'haspassword'; +------------------------+ | password | +------------------------+ | kDPg4wXyR8DDyA0MeEjIsw | +------------------------+ 1 row in set (0.00 sec)
(In reply to comment #2) > I don't really like the idea of a default password. People tend to keep > passwords like that and never change them. I makes it much easier to hack > patron accounts. > > When you change a password Koha can already generate a new random password in > the length specified in the sys prefs. I would like to see Koha generating a > password like this one upon saving a patron with an empty password field. > Koha can send out this password as a mail to the patron, if the library wants > to do this. We already can do this with manually entered passwords. > > Ideal would be a to create a one time password and force the patron to change > it when he logs into the OPAC for the first time. Perhaps these one time > passwords should even expire after a given time or be validated by a mail to > the patrons email account. I agree to all: - random one time passwords sent by email - force patrons to change it on first login And we wont need no changes into prefs.
The original description of this bug seems to be a duplicate of Bug 3674 and Bug 6224. The discussion has steered towards a new kind of password handling for new accounts, but that should have its own enhancement bug (and RFC too probably).