Bugzilla – Attachment 112895 Details for
Bug 26904
OPAC password recovery allows regexp in email
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26904: OPAC password recovery allows regexp in email
Bug-26904-OPAC-password-recovery-allows-regexp-in-.patch (text/plain), 1.99 KB, created by
Fridolin Somers
on 2020-11-03 08:32:04 UTC
(
hide
)
Description:
Bug 26904: OPAC password recovery allows regexp in email
Filename:
MIME Type:
Creator:
Fridolin Somers
Created:
2020-11-03 08:32:04 UTC
Size:
1.99 KB
patch
obsolete
>From 093e800694ddc3d1bac4577c52a7116080ab48f1 Mon Sep 17 00:00:00 2001 >From: Fridolin Somers <fridolin.somers@biblibre.com> >Date: Tue, 3 Nov 2020 09:19:34 +0100 >Subject: [PATCH] Bug 26904: OPAC password recovery allows regexp in email > >When using OPAC password recovery form, opac/opac-password-recovery.pl : >if one provides correct login and an email, there is a check that this email is one of patron's. > >This check uses RegExp with case insensitive : > if ( $email && !( any { /^$email$/i } @emails ) ) > >This is a security issue since one can simply enter '.*'. >Severity is normal because the login must be a correct. > >I propose to use simple string compare and remove the case insensitive. >If one does only provide email address it is case sensitive. > >Test plan : >1) Enable system preference OpacResetPassword >2) Go to OPAC > Log in to your account > Forgot your password? >3) Enter an existing userid or cardnumber and '.*' in 'Email' >4) Without patch the password recovery is send, with patch you get the > message 'No account was found with the provided information.' >5) Enter an existing userid or cardnumber and in 'Email' the > corresponding email but with different case >6) Without patch the password recovery is send, with patch you get the > message 'No account was found with the provided information.' >--- > opac/opac-password-recovery.pl | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl >index 57e13087c9..3e8499d2e2 100755 >--- a/opac/opac-password-recovery.pl >+++ b/opac/opac-password-recovery.pl >@@ -84,7 +84,7 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { > $firstNonEmptyEmail = $emails[0] if @emails; > > # Is the given email one of the borrower's ? >- if ( $email && !( any { /^$email$/i } @emails ) ) { >+ if ( $email && !( any { $email eq $_ } @emails ) ) { > $hasError = 1; > $errNoBorrowerFound = 1; > } >-- >2.29.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26904
:
112895
|
112898
|
112910
|
113223