Bug 8515 - OPAC password change does not obey OpacPasswordChange
Summary: OPAC password change does not obey OpacPasswordChange
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 3.8
Hardware: All All
: P5 - low normal (vote)
Assignee: Owen Leonard
QA Contact: Katrin Fischer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-27 13:49 UTC by Galen Charlton
Modified: 2013-12-05 20:01 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 8515 - OPAC password change does not obey OpacPasswordChange (7.38 KB, patch)
2012-11-02 16:58 UTC, Owen Leonard
Details | Diff | Splinter Review
[Signed off] Bug 8515 - OPAC password change does not obey OpacPasswordChange (7.39 KB, patch)
2012-11-08 17:19 UTC, Melia Meggs
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 8515 - OPAC password change does not obey OpacPasswordChange (7.54 KB, patch)
2012-11-25 20:16 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2012-07-27 13:49:20 UTC
Currently the OpacPasswordChange system preference only controls whether the user sees a link to the password change form.  If the user can guess the URL of the password reset form, they would still be able to change their password contrary to the to the system preference setting.
Comment 1 Galen Charlton 2012-07-27 15:48:10 UTC
Following up on an observation by Owen Leonard, the template (opac-passwd.tt) does include logic to suppress the form inputs if that system preference is off.  That's still not quite good enough -- a user could still supply the form parameters as URL parameters or via a POST and change their password.
Comment 2 Owen Leonard 2012-11-02 16:58:45 UTC Comment hidden (obsolete)
Comment 3 Melia Meggs 2012-11-07 23:32:17 UTC
I tried this first on master to see the bug, but I'm not sure I'm doing it right. Here's what I did:

1. Turn off OpacPasswordChange and navigate manually to opac-passwd.pl. I got the warning that I can't change your password.

2. Turn on OpacPasswordChange load the change password page and saved the page to my desktop. 

3. Turn off OpacPasswordChange and submit a password change via the saved page.

What I thought would happen here is that I'd be able to submit the password anyway, but what actually happened is that I loaded the password change page, typed in a new password, clicked submit, and got this error message (from Chrome, not from Koha):
This webpage is not found
No webpage was found for the web address: file://localhost/Users/meliameggs/Desktop/passwordchange_files/passwordchange.html
Error 6 (net::ERR_FILE_NOT_FOUND): The file or directory could not be found.

The same thing happened in Firefox:
File not found 
Firefox can't find the file at /cgi-bin/koha/opac-passwd.pl.
Check the file name for capitalization or other typing errors.
Check to see if the file was moved, renamed or deleted.

So I must not be clever enough to figure out how to change my password when I'm not supposed to - ha!

I got the same behavior after applying the patch, so I think someone else may need to test this one.
Comment 4 Owen Leonard 2012-11-08 15:40:50 UTC
(In reply to comment #3)
> This webpage is not found
> No webpage was found for the web address:
> file://localhost/Users/meliameggs/Desktop/passwordchange_files/
> passwordchange.html
> Error 6 (net::ERR_FILE_NOT_FOUND): The file or directory could not be found.

Yeah, because the saved HTML page doesn't save the full URL to which the form should be submitted. You'd have to look for the password form's <form> tag and add the full URL. It probably has the "action" attribute "/cgi-bin/koha/opac-passwd.pl"
Comment 5 Melia Meggs 2012-11-08 17:16:08 UTC
Ok!  I get it now!  I changed my password with OPACPasswordChange set to "don't allow" on master.  Thanks, Owen.  

Now to test the patch...
Comment 6 Melia Meggs 2012-11-08 17:19:21 UTC Comment hidden (obsolete)
Comment 7 Melia Meggs 2012-11-08 17:20:20 UTC
It works!  After applying the patch, I got a "You can't change your password" message.
Comment 8 Katrin Fischer 2012-11-25 20:16:12 UTC
Created attachment 13657 [details] [review]
[SIGNED-OFF] Bug 8515 - OPAC password change does not obey OpacPasswordChange

The OPAC change password template enforces the OpacPasswordChange
preference by preventing the form from appearing. However, the
script doesn't contain any check for OpacPasswordChange so it is
vulnerable to someone submitting data to it by some other means.

This patch adds a check for OpacPasswordChange to the script and
revises the template logic in order to show the right warning
in all circumstances.

To test, turn off OpacPasswordChange and navigate manually to
opac-passwd.pl. You should see a warning that you can't change
your password.

Turn on OpacPasswordChange load the change password page and
save the page to your desktop. Turn off OpacPasswordChange and
submit a password change via the saved page. Without the patch
this would result in a password change. After the patch it
should not.

Signed-off-by: Melia Meggs <melia@test.bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug and made sure patch fixes it.
Passes all tests and perlcritic.
Comment 9 Jared Camins-Esakov 2012-11-25 23:40:40 UTC
This patch has been pushed to master.
Comment 10 Chris Cormack 2012-11-26 07:11:37 UTC
Pushed to 3.10.x will be in 3.10.1
Comment 11 Chris Cormack 2012-11-26 07:56:31 UTC
Pushed to 3.8.x will be in 3.8.8
Comment 12 Liz Rea 2012-11-28 01:37:08 UTC
Patches do not apply to 3.6.x, please reopen and submit a patch for 3.6.x if necessary. 

Thanks!