Attachment 112910 Details for Bug 26904 – Bug 26904: OPAC password recovery allows regexp in email

[patch] Bug 26904: OPAC password recovery allows regexp in email

Bug-26904-OPAC-password-recovery-allows-regexp-in-.patch (text/plain), 2.06 KB, created by Nick Clemens (kidclamp) on 2020-11-03 10:50:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nick Clemens (kidclamp)

Created: 2020-11-03 10:50:18 UTC

Size: 2.06 KB

patch

obsolete

>From db846329f7e0d75e4ece9374a15b1b16cb007aee Mon Sep 17 00:00:00 2001
>From: Fridolin Somers <fridolin.somers@biblibre.com>
>Date: Tue, 3 Nov 2020 09:19:34 +0100
>Subject: [PATCH] Bug 26904: OPAC password recovery allows regexp in email
>
>When using OPAC password recovery form, opac/opac-password-recovery.pl :
>if one provides correct login and an email, there is a check that this email is one of patron's.
>
>This check uses RegExp with case insensitive :
>  if ( $email && !( any { /^$email$/i } @emails ) )
>
>This is a security issue since one can simply enter '.*'.
>Severity is normal because the login must be a correct.
>
>I propose to use simple string compare with lowercase to be case insensitive.
>
>Test plan :
>1) Don't apply patch
>2) Enable system preference 'OpacResetPassword'
>3) Go to 'OPAC > Log in to your account > Forgot your password?'
>4) Enter an existing userid or cardnumber and '.*' in 'Email'
>5) The password recovery is created ! (check table 'borrower_password_recovery')
>6) Apply patch
>7) Enter an existing userid or cardnumber and '.*' in 'Email'
>8) You get the message 'No account was found with the provided information.'
>9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
>10) The password recovery is created (check table 'borrower_password_recovery')
>
>Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
>---
> opac/opac-password-recovery.pl | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl
>index 57e13087c9..f4686bbb37 100755
>--- a/opac/opac-password-recovery.pl
>+++ b/opac/opac-password-recovery.pl
>@@ -84,7 +84,7 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) {
>             $firstNonEmptyEmail = $emails[0] if @emails;
> 
>             # Is the given email one of the borrower's ?
>-            if ( $email && !( any { /^$email$/i } @emails ) ) {
>+            if ( $email && !( any { lc($_) eq lc($email) } @emails ) ) {
>                 $hasError    = 1;
>                 $errNoBorrowerFound = 1;
>             }
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 26904: 112895 | 112898 | 112910 | 113223