Bugzilla – Attachment 131194 Details for
Bug 27812
Remove the ability to transmit a patron's plain text password over email
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27812: Remove the ability to transmit a patron's plain text password over email
Bug-27812-Remove-the-ability-to-transmit-a-patrons.patch (text/plain), 2.46 KB, created by
Martin Renvoize (ashimema)
on 2022-03-01 16:01:15 UTC
(
hide
)
Description:
Bug 27812: Remove the ability to transmit a patron's plain text password over email
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-03-01 16:01:15 UTC
Size:
2.46 KB
patch
obsolete
>From 00c13e3febf39cc9ad893880413f94efcc3f9c80 Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Fri, 26 Feb 2021 13:16:58 -0500 >Subject: [PATCH] Bug 27812: Remove the ability to transmit a patron's plain > text password over email > >We should not give libraries the ability to compromise patron accounts, >it is considered a huge security issue and nobody in network security >would never recommend allowing passwords to be transmitted in clear text >over email. > >It should simply not be possible to send a patron's password in plain text >via email. As such, we should remove this ability from Koha. > >Test Plan: >1) Apply this patch >2) Create a patron to generate the ACCTDETAILS email >3) Note you can no longer transmit the patron's password in the email > >Signed-off-by: Amit Gupta <amitddng135@gmail.com> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > installer/data/mysql/en/mandatory/sample_notices.yml | 3 ++- > members/memberentry.pl | 1 + > 2 files changed, 3 insertions(+), 1 deletion(-) > >diff --git a/installer/data/mysql/en/mandatory/sample_notices.yml b/installer/data/mysql/en/mandatory/sample_notices.yml >index ffcb4cb5d4..96995aba54 100644 >--- a/installer/data/mysql/en/mandatory/sample_notices.yml >+++ b/installer/data/mysql/en/mandatory/sample_notices.yml >@@ -962,10 +962,11 @@ tables: > - "Your new Koha account details are:" > - "" > - "User: <<borrowers.userid>>" >- - "Password: <<borrowers.password>>" > - "" > - "If you have any problems or questions regarding your account, please contact your Koha Administrator." > - "" >+ - "If you do not have your account password, please contact your Koha Administrator." >+ - "" > - "Thank you," > - "Koha Administrator" > - "kohaadmin@yoursite.org" >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 98c62f2139..771d2f2689 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -456,6 +456,7 @@ if ((!$nok) and $nodouble and ($op eq 'insert' or $op eq 'save')){ > add_guarantors( $patron, $input ); > $borrowernumber = $patron->borrowernumber; > $newdata{'borrowernumber'} = $borrowernumber; >+ delete $newdata{password}; > } > > # If 'AutoEmailOpacUser' syspref is on, email user their account details from the 'notice' that matches the user's branchcode. >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27812
:
117395
|
118708
|
118797
|
119176
|
131166
|
131167
|
131168
| 131194 |
131195
|
131196
|
131197