Attachment 42324 Details for Bug 14509 – Bug 14509: Reject invalid passwords

[patch] Bug 14509: Reject invalid passwords

Bug-14509-Reject-invalid-passwords.patch (text/plain), 6.16 KB, created by Marcel de Rooy on 2015-09-03 14:07:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2015-09-03 14:07:12 UTC

Size: 6.16 KB

patch

obsolete

>From 4be52262656bbca62d19bb66927d98ddbeb307f8 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 14 Jul 2015 15:33:34 +0100
>Subject: [PATCH] Bug 14509: Reject invalid passwords
>MIME-Version: 1.0
>Content-Type: text/plain; charset=utf-8
>Content-Transfer-Encoding: 8bit
>Content-Type: text/plain; charset=utf-8
>
>Bug 10177 rejects password with leading or trailing whitespaces, but
>only on the member-password page.
>It's not consistent to only do this check on 1 place.
>This patch adds the check for the 2 other places: memberentry and at the
>OPAC.
>
>Test plan:
>1/ Edit a patron and set a password with leading and/or trailing
>whitespaces. You should not be allowed to do it (no server side check).
>2/ Same at the OPAC ("Change you password" tab). Here there is a server
>side check.
>
>Followed test plan. Works as expected.
>Signed-off-by: Marc VÃ©ron <veron@veron.ch>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/js/members.js               |   11 +++++++++++
> .../prog/en/modules/members/member-password.tt              |    5 +++--
> .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt |    1 +
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt     |    3 +++
> opac/opac-passwd.pl                                         |    8 +++++++-
> 5 files changed, 25 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/js/members.js b/koha-tmpl/intranet-tmpl/prog/en/js/members.js
>index 44ea578..75e230b 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/js/members.js
>+++ b/koha-tmpl/intranet-tmpl/prog/en/js/members.js
>@@ -81,6 +81,12 @@ var myDate2=document.form.dateexpiry.value.split ('/');
> }
> //end function
> 
>+function check_password( password ) {
>+    if ( password.match(/^\s/) || password.match(/\s$/)) {
>+        return false;
>+    }
>+    return true;
>+}
> 
> // function to test all fields in forms and nav in different forms(1 ,2 or 3)
> function check_form_borrowers(nav){
>@@ -106,6 +112,11 @@ function check_form_borrowers(nav){
>             statut=1;
>     }
> 
>+    if ( ! check_password( document.form.password.value ) ) {
>+        message_champ += MSG_PASSWORD_CONTAINS_TRAILING_SPACES;
>+        statut = 1;
>+    }
>+
>     //patrons form to test if you checked no to the question of double
>     if (statut!=1 && document.form.check_member.value > 0 ) {
>         if (!(document.form_double.answernodouble.checked)){
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
>index 4cb04ef..6b0e965 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
>@@ -4,13 +4,14 @@
> <script type="text/JavaScript">
> //<![CDATA[
>     $(document).ready(function() {
>+        var MSG_PASSWORD_CONTAINS_TRAILING_SPACES = _("Password contains leading and/or trailing spaces.");
>         $("#changepasswordf").submit(function(){
>             if($("input[name='newpassword']").val() != $("input[name='newpassword2']").val()){
>                 alert(_("Passwords do not match"));
>                 return false;
>             } else {
>-                if ($("input[name='newpassword']").val().match(/^\s/) || $("input[name='newpassword']").val().match(/\s$/)) {
>-                  alert(_("Password contains leading and/or trailing spaces."));
>+                if ( ! check_password( $("input[name='newpassword']").val() ) ) {
>+                  alert(MSG_PASSWORD_CONTAINS_TRAILING_SPACES);
>                   return false;
>               } else {
>                 return true;
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>index 56b58e8..a3b7a9d 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>@@ -156,6 +156,7 @@
>         var MSG_LATE_EXPIRY = _("Warning: Expiration date falls before enrollment date");
>         var MSG_DUPLICATE_SUSPICION = _("Please confirm whether this is a duplicate patron");
>         var MSG_PASSWORD_MISMATCH = _("The passwords entered do not match");
>+        var MSG_PASSWORD_CONTAINS_TRAILING_SPACES = _("Password contains leading and/or trailing spaces.");
> //]]>
> </script>
> <script type="text/javascript" src="[% themelang %]/js/members.js"></script>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
>index 8c6ad5f..f2766c9 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
>@@ -38,6 +38,9 @@
>                                 [% IF ( WrongPass ) %]
>                                 Your current password was entered incorrectly.  If this problem persists, please ask a librarian to re-set your password for you.
>                                 [% END %]
>+                                [% IF PasswordContainsTrailingSpaces %]
>+                                    Your password contains leading and/or trailing spaces.
>+                                [% END %]
>                             </p>
>                         </div>
>                     [% END # /IF Error_messages %]
>diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl
>index 2eaf6cc..56e9967 100755
>--- a/opac/opac-passwd.pl
>+++ b/opac/opac-passwd.pl
>@@ -54,7 +54,13 @@ if ( C4::Context->preference("OpacPasswordChange") ) {
>         && $query->param('Confirm') )
>     {
>         if ( goodkey( $dbh, $borrowernumber, $query->param('Oldkey') ) ) {
>-            if ( $query->param('Newkey') eq $query->param('Confirm')
>+            if ( $query->param('Newkey') =~ m|^\s+| or $query->param('Newkey') =~ m|\s+$| ) {
>+                $template->param(
>+                    Error_messages => 1,
>+                    PasswordContainsTrailingSpaces => 1,
>+                );
>+            }
>+            elsif ( $query->param('Newkey') eq $query->param('Confirm')
>                 && length( $query->param('Confirm') ) >= $minpasslen )
>             {    # Record password
>                 my $clave = hash_password( $query->param('Newkey') );
>-- 
>1.7.10.4

Actions: View | Diff | Splinter Review

Attachments on bug 14509: 40993 | 41295 | 42194 | 42324 | 42325