Bugzilla – Attachment 133989 Details for
Bug 29924
Introduce password expiration to patron categories
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29924: Avoid leaking information on wrong credentials
Bug-29924-Avoid-leaking-information-on-wrong-crede.patch (text/plain), 2.56 KB, created by
Tomás Cohen Arazi
on 2022-04-26 18:08:34 UTC
(
hide
)
Description:
Bug 29924: Avoid leaking information on wrong credentials
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi
Created:
2022-04-26 18:08:34 UTC
Size:
2.56 KB
patch
obsolete
>From 44dfd8ad2b72e4411a45a8a2c9ffbeface911fca Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Tue, 26 Apr 2022 15:03:05 -0300 >Subject: [PATCH] Bug 29924: Avoid leaking information on wrong credentials > >If the passed credentials are wrong, we shouldn't expose things like the >password is expired. > >This patch takes care of that. > >To test: >1. Have a known patron with password_expiration_date set so its > password is expired. Can be done like: > $ koha-mysql kohadev > > UPDATE borrowers \ > SET password_expiration_date='2022-04-25' \ > WHERE borrowernumber=132; > Note: change the borrowernumber >2. Attempt to login to the OPAC with wrong credentials >=> SUCCESS: You are rejected, with a message telling credentials are > wrong >=> FAIL: You are told the password is expired. >3. Apply this patch and restart Plack >4. Repeat 2 >=> SUCCESS: You are rejected, credentials are wrong and no mention to > password being expired. > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > C4/Auth.pm | 1 - > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 2 +- > 2 files changed, 1 insertion(+), 2 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 26066bb32d0..48b73bca50e 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1407,7 +1407,6 @@ sub checkauth { > PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"), > opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'}, > too_many_login_attempts => ( $patron and $patron->account_locked ), >- password_has_expired => ( $patron and $patron->password_expired ) > ); > > $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') ); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 9f0df7bd083..acba29d1b0a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -167,7 +167,7 @@ > [% END # /IF GoogleOpenIDConnect %] > [% END # /UNLESS OPACShibOnly %] > >- [% IF password_has_expired %] >+ [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %] > <div class="alert alert-info"> > <p><strong>Error: </strong>Your password has expired!</p> > </div> >-- >2.36.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29924
:
129705
|
129706
|
129707
|
129708
|
129762
|
129763
|
129764
|
129765
|
129766
|
129823
|
129953
|
129954
|
129955
|
129956
|
129957
|
130116
|
130117
|
130118
|
130119
|
130120
|
130495
|
130500
|
130501
|
130502
|
130503
|
130504
|
130505
|
130557
|
130558
|
130559
|
130560
|
130561
|
130562
|
130563
|
130677
|
130678
|
130679
|
130680
|
130681
|
130682
|
130683
|
131128
|
132059
|
132060
|
132061
|
132062
|
132063
|
132064
|
132065
|
132066
|
132084
|
132085
|
132086
|
132087
|
132088
|
132089
|
132090
|
132091
|
132092
|
133741
|
133742
|
133743
|
133744
|
133745
|
133746
|
133747
|
133748
|
133801
|
133802
|
133803
|
133804
|
133805
|
133806
|
133807
|
133808
|
133809
|
133810
| 133989 |
134758