Bugzilla – Attachment 112756 Details for
Bug 19133
Password recovery routes
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19133: (QA follow-up) More contemporary language
Bug-19133-QA-follow-up-More-contemporary-language.patch (text/plain), 10.86 KB, created by
Tomás Cohen Arazi (tcohen)
on 2020-10-30 20:03:24 UTC
(
hide
)
Description:
Bug 19133: (QA follow-up) More contemporary language
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2020-10-30 20:03:24 UTC
Size:
10.86 KB
patch
obsolete
>From 244abe6b9b36c6598cb0ab1f706a39ed61a12ff3 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 30 Oct 2020 16:28:39 -0300 >Subject: [PATCH] Bug 19133: (QA follow-up) More contemporary language > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/Patron/Password/Recovery.pm | 8 ++++---- > api/v1/swagger/paths/patrons.json | 2 +- > ...133-2_Add_permission_get_password_reset_uuid.perl | 10 +++++++--- > ...-Password-recovery-custom-link-allowed-hosts.perl | 12 ++++++++++++ > ...9133-Password-recovery-custom-link-whitelist.perl | 11 ----------- > installer/data/mysql/mandatory/sysprefs.sql | 2 +- > .../prog/en/modules/admin/preferences/opac.pref | 2 +- > t/db_dependent/api/v1/patrons_password_recovery.t | 6 +++--- > 8 files changed, 29 insertions(+), 24 deletions(-) > create mode 100644 installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-allowed-hosts.perl > delete mode 100644 installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-whitelist.perl > >diff --git a/Koha/Patron/Password/Recovery.pm b/Koha/Patron/Password/Recovery.pm >index 753601378ce..a17e55134e9 100644 >--- a/Koha/Patron/Password/Recovery.pm >+++ b/Koha/Patron/Password/Recovery.pm >@@ -156,10 +156,10 @@ sub SendPasswordRecoveryEmail { > if (defined $params->{url}) { > # Make sure host name exists in whitelist > my $url = $params->{url}; >- my $whitelist = C4::Context->preference( >- 'OpacResetPasswordHostWhitelist' >+ my $allowed_list = C4::Context->preference( >+ 'OpacResetPasswordAllowedHosts' > ); >- my @allowed_hosts = split /[,\s\|]/, $whitelist if defined $whitelist; >+ my @allowed_hosts = split /[,\s\|]/, $allowed_list if defined $allowed_list; > foreach my $allowed_host (@allowed_hosts) { > if ($url =~ /^https?:\/\/$allowed_host/) { > $url =~ s/{uuid}/$uuid_str/gi; >@@ -168,7 +168,7 @@ sub SendPasswordRecoveryEmail { > } > } > Koha::Exceptions::WrongParameter->throw( error => 'System preference' >- . ' OpacResetPasswordHostWhitelist does' >+ . ' OpacResetPasswordAllowedHosts does' > . " not contain the requested host of '$url'" > ) if $uuidLink ne $params->{url}; > } >diff --git a/api/v1/swagger/paths/patrons.json b/api/v1/swagger/paths/patrons.json >index 522b072d93b..ccf0533cf03 100644 >--- a/api/v1/swagger/paths/patrons.json >+++ b/api/v1/swagger/paths/patrons.json >@@ -731,7 +731,7 @@ > "type": "string" > }, > "complete_url": { >- "description": "The location where patron will complete their password recovery. This location will be added into the password recovery email. To avoid malicious use, whitelist certain hosts in OpacResetPasswordHostWhitelist system preference and forbid all other custom links. Use {uuid} for adding the password recovery uuid into your custom link. It will be replaced by the actual uuid in the email.", >+ "description": "The location where patron will complete their password recovery. This location will be added into the password recovery email. To avoid malicious use, allow certain hosts in OpacResetPasswordAllowedHosts system preference and forbid all other custom links. Use {uuid} for adding the password recovery uuid into your custom link. It will be replaced by the actual uuid in the email.", > "type": "string" > }, > "skip_email": { >diff --git a/installer/data/mysql/atomicupdate/Bug-19133-2_Add_permission_get_password_reset_uuid.perl b/installer/data/mysql/atomicupdate/Bug-19133-2_Add_permission_get_password_reset_uuid.perl >index 924631ce35e..5754d9d9c13 100644 >--- a/installer/data/mysql/atomicupdate/Bug-19133-2_Add_permission_get_password_reset_uuid.perl >+++ b/installer/data/mysql/atomicupdate/Bug-19133-2_Add_permission_get_password_reset_uuid.perl >@@ -1,8 +1,12 @@ > $DBversion = 'XXX'; # will be replaced by the RM > if( CheckVersion( $DBversion ) ) { > >- $dbh->do( "INSERT INTO permissions (module_bit, code, description) VALUES ( 4, 'get_password_reset_uuid', 'Allow the user to get password reset uuid when recovering passwords. Useful for third party service integrations that wish to do something with the uuid, such as handle emails themselves instead of Koha.')" ); >+ $dbh->do(q{ >+ INSERT INTO permissions >+ (module_bit, code, description) >+ VALUES >+ ( 4, 'get_password_reset_uuid', 'Allow the user to get password reset uuid when recovering passwords. Useful for third party service integrations that wish to do something with the uuid, such as handle emails themselves instead of Koha.'); >+ }); > >- SetVersion( $DBversion ); >- print "Upgrade to $DBversion done (Bug 19133 - Add permission get_password_reset_uuid.)\n"; >+ NewVersion( $DBversion, 19133, "Password recovery via REST API - Add permission get_password_reset_uuid"); > } >diff --git a/installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-allowed-hosts.perl b/installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-allowed-hosts.perl >new file mode 100644 >index 00000000000..24be48a37d3 >--- /dev/null >+++ b/installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-allowed-hosts.perl >@@ -0,0 +1,12 @@ >+$DBversion = 'XXX'; # will be replaced by the RM >+if( CheckVersion( $DBversion ) ) { >+ >+ $dbh->do(q{ >+ INSERT INTO systempreferences >+ (variable, value, options, explanation, type) >+ VALUES >+ ('OpacResetPasswordAllowedHosts', '', '', 'Allowed external host names for password reset in third party service. Separate list by whitespace, comma or |', 'free'); >+ }); >+ >+ NewVersion( $DBversion, 19133, "Password recovery via REST API - Allowed hosts for custom links"); >+} >diff --git a/installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-whitelist.perl b/installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-whitelist.perl >deleted file mode 100644 >index fc1fe375195..00000000000 >--- a/installer/data/mysql/atomicupdate/Bug-19133-Password-recovery-custom-link-whitelist.perl >+++ /dev/null >@@ -1,11 +0,0 @@ >-$DBversion = 'XXX'; # will be replaced by the RM >-if( CheckVersion( $DBversion ) ) { >- >- $dbh->do( >- "INSERT INTO systempreferences (variable, value, options, explanation, type) VALUES ('OpacResetPasswordHostWhitelist', '', '', 'Whitelist external host names for password reset in third party service. Separate list by whitespace, comma or |', 'free')" >- ); >- >- # Always end with this (adjust the bug info) >- SetVersion( $DBversion ); >- print "Upgrade to $DBversion done (Bug 19133 - Password recovery via REST API - whitelist custom links)\n"; >-} >diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql >index 02c170b9039..ab5c233fd48 100644 >--- a/installer/data/mysql/mandatory/sysprefs.sql >+++ b/installer/data/mysql/mandatory/sysprefs.sql >@@ -439,7 +439,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` > ('OpacRenewalBranch','checkoutbranch','itemhomebranch|patronhomebranch|checkoutbranch|none','Choose how the branch for an OPAC renewal is recorded in statistics','Choice'), > ('OPACReportProblem', 0, NULL, 'Allow patrons to submit problem reports for OPAC pages to the library or Koha Administrator', 'YesNo'), > ('OpacResetPassword','0','','Shows the ''Forgot your password?'' link in the OPAC','YesNo'), >-('OpacResetPasswordHostWhitelist','','','Whitelist external host names for password reset in third party service. Separate list by whitespace, comma or |','free'), >+('OpacResetPasswordAllowedHosts','','','Allowed external host names for password reset in third party service. Separate list by whitespace, comma or |','free'), > ('OPACResultsLibrary', 'homebranch', 'homebranch|holdingbranch', 'Defines whether the OPAC displays the holding or home branch in search results when using XSLT', 'Choice'), > ('OPACResultsSidebar','','70|10','Define HTML to be included on the search results page, underneath the facets sidebar','Textarea'), > ('OPACSearchForTitleIn','<a href=\"https://worldcat.org/search?q={TITLE}\" target=\"_blank\">Other Libraries (WorldCat)</a>\n<a href=\"https://scholar.google.com/scholar?q={TITLE}\" target=\"_blank\">Other Databases (Google Scholar)</a>\n<a href=\"https://www.bookfinder.com/search/?author={AUTHOR}&title={TITLE}&st=xl&ac=qr\" target=\"_blank\">Online Stores (Bookfinder.com)</a>\n<a href=\"https://openlibrary.org/search?author=({AUTHOR})&title=({TITLE})\" target=\"_blank\">Open Library (openlibrary.org)</a>','70|10','Enter the HTML that will appear in the \'Search for this title in\' box on the detail page in the OPAC. Enter {TITLE}, {AUTHOR}, or {ISBN} in place of their respective variables in the URL. Leave blank to disable \'More Searches\' menu.','Textarea'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref >index c72d4091352..10120fe2c74 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref >@@ -390,7 +390,7 @@ OPAC: > - " to recover their password via e-mail in the OPAC." > - > - "Allow the following " >- - pref: OpacResetPasswordHostWhitelist >+ - pref: OpacResetPasswordAllowedHosts > type: textarea > - " host names of third party services to be used as external password reset locations. Separate list elements by new line, whitespace, comma or |." > - >diff --git a/t/db_dependent/api/v1/patrons_password_recovery.t b/t/db_dependent/api/v1/patrons_password_recovery.t >index 62cb6e28856..176429886d2 100644 >--- a/t/db_dependent/api/v1/patrons_password_recovery.t >+++ b/t/db_dependent/api/v1/patrons_password_recovery.t >@@ -197,7 +197,7 @@ subtest 'recovery() tests' => sub { > plan tests => 5; > > t::lib::Mocks::mock_preference( >- 'OpacResetPasswordHostWhitelist', '' >+ 'OpacResetPasswordAllowedHosts', '' > ); > > $tx = $t->ua->build_tx(POST => $url => json => { >@@ -211,7 +211,7 @@ subtest 'recovery() tests' => sub { > ->status_is(400); > > t::lib::Mocks::mock_preference( >- 'OpacResetPasswordHostWhitelist', 'allowed' >+ 'OpacResetPasswordAllowedHosts', 'allowed' > ); > > $tx = $t->ua->build_tx(POST => $url => json => { >@@ -249,7 +249,7 @@ subtest 'recovery() tests' => sub { > plan tests => 10; > > t::lib::Mocks::mock_preference( >- 'OpacResetPasswordHostWhitelist', 'anotherallowed' >+ 'OpacResetPasswordAllowedHosts', 'anotherallowed' > ); > my ($service_borrowernumber, $service_session) = create_user_and_session({ > authorized => 1 >-- >2.29.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19133
:
66415
|
66416
|
66419
|
94551
|
94553
|
94554
|
112751
|
112752
|
112753
|
112755
|
112756
|
112757
|
112758
|
112937
|
112938
|
112939
|
112940
|
112941
|
112942
|
112943
|
112944
|
113328