Bugzilla – Attachment 84640 Details for
Bug 22253
Koha throws an exception when updating a borrower with an insecure password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22253: Check we actually need to update the password
Bug-22253-Check-we-actually-need-to-update-the-pas.patch (text/plain), 1.90 KB, created by
Owen Leonard
on 2019-02-01 17:37:12 UTC
(
hide
)
Description:
Bug 22253: Check we actually need to update the password
Filename:
MIME Type:
Creator:
Owen Leonard
Created:
2019-02-01 17:37:12 UTC
Size:
1.90 KB
patch
obsolete
>From 246c6cb53217534e74461ee1261c9d653238165b Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Thu, 31 Jan 2019 16:30:25 -0300 >Subject: [PATCH] Bug 22253: Check we actually need to update the password > >This patch makes memberentry.pl check if password needs to be updated >before attempting to call set_password. Above this there's a check that >won't raise any errors if no password is passed, or the default string (****) is received. > >So we could reach that line of code with no password, but the code >wouldn't check that. > >To test: >- In master, edit any patron without changing the password >=> FAIL: It raises an exception >- Apply this patch >- Edit the patron withtout changing the password >=> SUCCESS: Edit successful >- Edit the patron, changing the password >- Try to login with the new password >=> SUCCESS: The password got changed correctly >- Sigh off :-D > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> >--- > members/memberentry.pl | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 788f76c..031a8e1 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -536,7 +536,10 @@ if ((!$nok) and $nodouble and ($op eq 'insert' or $op eq 'save')){ > # patron attributes or messaging preferences sections > > # should never raise an exception as password validity is checked above >- $patron->set_password({ password => $newdata{password} }); >+ my $password = $newdata{password}; >+ if ( $password and $password ne '****' ) { >+ $patron->set_password({ password => $password }); >+ } > > if (C4::Context->preference('ExtendedPatronAttributes') and $input->param('setting_extended_patron_attributes')) { > C4::Members::Attributes::SetBorrowerAttributes($borrowernumber, $extended_patron_attributes); >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22253
:
84594
|
84640
|
84657