From 093e800694ddc3d1bac4577c52a7116080ab48f1 Mon Sep 17 00:00:00 2001 From: Fridolin Somers Date: Tue, 3 Nov 2020 09:19:34 +0100 Subject: [PATCH] Bug 26904: OPAC password recovery allows regexp in email When using OPAC password recovery form, opac/opac-password-recovery.pl : if one provides correct login and an email, there is a check that this email is one of patron's. This check uses RegExp with case insensitive : if ( $email && !( any { /^$email$/i } @emails ) ) This is a security issue since one can simply enter '.*'. Severity is normal because the login must be a correct. I propose to use simple string compare and remove the case insensitive. If one does only provide email address it is case sensitive. Test plan : 1) Enable system preference OpacResetPassword 2) Go to OPAC > Log in to your account > Forgot your password? 3) Enter an existing userid or cardnumber and '.*' in 'Email' 4) Without patch the password recovery is send, with patch you get the message 'No account was found with the provided information.' 5) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case 6) Without patch the password recovery is send, with patch you get the message 'No account was found with the provided information.' --- opac/opac-password-recovery.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl index 57e13087c9..3e8499d2e2 100755 --- a/opac/opac-password-recovery.pl +++ b/opac/opac-password-recovery.pl @@ -84,7 +84,7 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { $firstNonEmptyEmail = $emails[0] if @emails; # Is the given email one of the borrower's ? - if ( $email && !( any { /^$email$/i } @emails ) ) { + if ( $email && !( any { $email eq $_ } @emails ) ) { $hasError = 1; $errNoBorrowerFound = 1; } -- 2.29.1