Back to bug 21311
| Who | When | What | Removed | Added |
|---|---|---|---|---|
| m.de.rooy | 2018-10-10 14:03:57 UTC | Product | Koha security | Koha |
| Assignee | chris | m.de.rooy | ||
| Component | Koha | Architecture, internals, and plumbing | ||
| Summary | Should we tell that an account has been locked ? | Remove locked message from opac-auth.tt | ||
| Group | Koha security | |||
| Status | NEW | ASSIGNED | ||
| m.de.rooy | 2018-10-10 14:04:11 UTC | Version | unspecified | master |
| m.de.rooy | 2018-10-10 14:16:50 UTC | Status | ASSIGNED | Needs Signoff |
| Patch complexity | --- | String patch | ||
| m.de.rooy | 2018-10-10 14:17:27 UTC | Severity | normal | major |
| CC | dpavlin | |||
| Component | Architecture, internals, and plumbing | Authentication | ||
| Patch complexity | String patch | Trivial patch | ||
| m.de.rooy | 2018-10-11 08:20:28 UTC | Attachment #80352 Attachment is obsolete | 0 | 1 |
| mtompset | 2018-10-15 16:55:24 UTC | Status | Needs Signoff | Signed Off |
| mtompset | 2018-10-15 16:55:28 UTC | Attachment #80388 Attachment is obsolete | 0 | 1 |
| mtompset | 2018-10-15 16:58:22 UTC | CC | mtompset | |
| martin.renvoize | 2018-10-16 18:19:30 UTC | CC | martin.renvoize | |
| m.de.rooy | 2018-10-25 10:05:55 UTC | Attachment #81123 Attachment is obsolete | 0 | 1 |
| m.de.rooy | 2018-10-25 10:06:07 UTC | Comment 18 Tag | obsolete | |
| m.de.rooy | 2018-10-25 10:11:38 UTC | Attachment #81124 Attachment is obsolete | 0 | 1 |
| m.de.rooy | 2018-10-25 10:12:50 UTC | Comment 21 Tag | obsolete | |
| m.de.rooy | 2018-10-25 10:13:04 UTC | Comment 22 Tag | obsolete | |
| m.de.rooy | 2018-10-25 10:13:07 UTC | Comment 23 Tag | obsolete | |
| m.de.rooy | 2018-10-25 10:13:09 UTC | Comment 24 Tag | obsolete | |
| m.de.rooy | 2018-10-25 10:13:15 UTC | Comment 20 Tag | obsolete | |
| katrin.fischer | 2018-10-28 12:13:35 UTC | Status | Signed Off | Passed QA |
| katrin.fischer | 2018-10-28 12:14:45 UTC | Keywords | release-notes-needed | |
| mtompset | 2018-10-28 14:56:45 UTC | Text to go in the release notes | , users should be reminded that they can always reset their password or contact library staff for help. It is good security practice to not provide details which could confirm or deny the existence of an account. Previously, the simple "This account has been locked!" confirmed its existence which would only encourage more attacks by hackers. To prevent aiding malicious attacks, the message has been changed to something that does not expressly state the account has been locked. It only mentions that accounts will be locked after a number of failed attempts, instead of saying whether it is locked or not. So while a successful attempt will seem to have an invalid username or password suggestion after the account is locked |
|
| m.de.rooy | 2018-10-29 08:57:20 UTC | Attachment #81403 Attachment is obsolete | 0 | 1 |
| m.de.rooy | 2018-10-29 09:07:59 UTC | Status | Passed QA | Pushed to Master |
| m.de.rooy | 2018-10-29 09:10:31 UTC | Keywords | release-notes-needed | |
| martin.renvoize | 2018-11-08 15:33:38 UTC | Status | Pushed to Master | Pushed to Stable |
| fridolin.somers | 2018-11-28 10:37:38 UTC | Resolution | --- | FIXED |
| Status | Pushed to Stable | RESOLVED | ||
| jonathan.druart | 2019-03-21 16:28:51 UTC | Depends on | 18314 | |
| katrin.fischer | 2020-01-06 20:17:14 UTC | Status | RESOLVED | CLOSED |
| dcook | 2020-09-30 08:18:37 UTC | CC | dcook | |
| katrin.fischer | 2020-10-18 17:03:59 UTC | See Also | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26727 |
Back to bug 21311