Back to bug 21311
Who | When | What | Removed | Added |
---|---|---|---|---|
m.de.rooy | 2018-10-10 14:03:57 UTC | Status | NEW | ASSIGNED |
Group | Koha security | |||
Component | Koha | Architecture, internals, and plumbing | ||
Product | Koha security | Koha | ||
Summary | Should we tell that an account has been locked ? | Remove locked message from opac-auth.tt | ||
Assignee | chris | m.de.rooy | ||
m.de.rooy | 2018-10-10 14:04:11 UTC | Version | unspecified | master |
m.de.rooy | 2018-10-10 14:16:50 UTC | Status | ASSIGNED | Needs Signoff |
Patch complexity | --- | String patch | ||
m.de.rooy | 2018-10-10 14:17:27 UTC | Patch complexity | String patch | Trivial patch |
CC | dpavlin | |||
Component | Architecture, internals, and plumbing | Authentication | ||
Severity | normal | major | ||
m.de.rooy | 2018-10-11 08:20:28 UTC | Attachment #80352 Attachment is obsolete | 0 | 1 |
mtompset | 2018-10-15 16:55:24 UTC | Status | Needs Signoff | Signed Off |
mtompset | 2018-10-15 16:55:28 UTC | Attachment #80388 Attachment is obsolete | 0 | 1 |
mtompset | 2018-10-15 16:58:22 UTC | CC | mtompset | |
martin.renvoize | 2018-10-16 18:19:30 UTC | CC | martin.renvoize | |
m.de.rooy | 2018-10-25 10:05:55 UTC | Attachment #81123 Attachment is obsolete | 0 | 1 |
m.de.rooy | 2018-10-25 10:06:07 UTC | Comment 18 Tag | obsolete | |
m.de.rooy | 2018-10-25 10:11:38 UTC | Attachment #81124 Attachment is obsolete | 0 | 1 |
m.de.rooy | 2018-10-25 10:12:50 UTC | Comment 21 Tag | obsolete | |
m.de.rooy | 2018-10-25 10:13:04 UTC | Comment 22 Tag | obsolete | |
m.de.rooy | 2018-10-25 10:13:07 UTC | Comment 23 Tag | obsolete | |
m.de.rooy | 2018-10-25 10:13:09 UTC | Comment 24 Tag | obsolete | |
m.de.rooy | 2018-10-25 10:13:15 UTC | Comment 20 Tag | obsolete | |
katrin.fischer | 2018-10-28 12:13:35 UTC | Status | Signed Off | Passed QA |
katrin.fischer | 2018-10-28 12:14:45 UTC | Keywords | release-notes-needed | |
mtompset | 2018-10-28 14:56:45 UTC | Text to go in the release notes | It is good security practice to not provide details which could confirm or deny the existence of an account. Previously, instead of saying whether it is locked or not. So while a successful attempt will seem to have an invalid username or password suggestion after the account is locked, the simple "This account has been locked!" confirmed its existence which would only encourage more attacks by hackers. To prevent aiding malicious attacks, users should be reminded that they can always reset their password or contact library staff for help., the message has been changed to something that does not expressly state the account has been locked. It only mentions that accounts will be locked after a number of failed attempts |
|
m.de.rooy | 2018-10-29 08:57:20 UTC | Attachment #81403 Attachment is obsolete | 0 | 1 |
m.de.rooy | 2018-10-29 09:07:59 UTC | Status | Passed QA | Pushed to Master |
m.de.rooy | 2018-10-29 09:10:31 UTC | Keywords | release-notes-needed | |
martin.renvoize | 2018-11-08 15:33:38 UTC | Status | Pushed to Master | Pushed to Stable |
fridolin.somers | 2018-11-28 10:37:38 UTC | Resolution | --- | FIXED |
Status | Pushed to Stable | RESOLVED | ||
jonathan.druart | 2019-03-21 16:28:51 UTC | Depends on | 18314 | |
katrin.fischer | 2020-01-06 20:17:14 UTC | Status | RESOLVED | CLOSED |
dcook | 2020-09-30 08:18:37 UTC | CC | dcook | |
katrin.fischer | 2020-10-18 17:03:59 UTC | See Also | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26727 |
Back to bug 21311