Back to bug 21311

Who When What Removed Added
m.de.rooy 2018-10-10 14:03:57 UTC Product Koha security Koha
Assignee chris m.de.rooy
Component Koha Architecture, internals, and plumbing
Summary Should we tell that an account has been locked ? Remove locked message from opac-auth.tt
Group Koha security
Status NEW ASSIGNED
m.de.rooy 2018-10-10 14:04:11 UTC Version unspecified master
m.de.rooy 2018-10-10 14:16:50 UTC Status ASSIGNED Needs Signoff
Patch complexity --- String patch
m.de.rooy 2018-10-10 14:17:27 UTC Severity normal major
CC dpavlin
Component Architecture, internals, and plumbing Authentication
Patch complexity String patch Trivial patch
m.de.rooy 2018-10-11 08:20:28 UTC Attachment #80352 Attachment is obsolete 0 1
mtompset 2018-10-15 16:55:24 UTC Status Needs Signoff Signed Off
mtompset 2018-10-15 16:55:28 UTC Attachment #80388 Attachment is obsolete 0 1
mtompset 2018-10-15 16:58:22 UTC CC mtompset
martin.renvoize 2018-10-16 18:19:30 UTC CC martin.renvoize
m.de.rooy 2018-10-25 10:05:55 UTC Attachment #81123 Attachment is obsolete 0 1
m.de.rooy 2018-10-25 10:06:07 UTC Comment 18 Tag obsolete
m.de.rooy 2018-10-25 10:11:38 UTC Attachment #81124 Attachment is obsolete 0 1
m.de.rooy 2018-10-25 10:12:50 UTC Comment 21 Tag obsolete
m.de.rooy 2018-10-25 10:13:04 UTC Comment 22 Tag obsolete
m.de.rooy 2018-10-25 10:13:07 UTC Comment 23 Tag obsolete
m.de.rooy 2018-10-25 10:13:09 UTC Comment 24 Tag obsolete
m.de.rooy 2018-10-25 10:13:15 UTC Comment 20 Tag obsolete
katrin.fischer 2018-10-28 12:13:35 UTC Status Signed Off Passed QA
katrin.fischer 2018-10-28 12:14:45 UTC Keywords release-notes-needed
mtompset 2018-10-28 14:56:45 UTC Text to go in the release notes , users should be reminded that they can always reset their password or contact library staff for help. It is good security practice to not provide details which could confirm or deny the existence of an account. Previously, the simple "This account has been locked!" confirmed its existence which would only encourage more attacks by hackers.

To prevent aiding malicious attacks, the message has been changed to something that does not expressly state the account has been locked. It only mentions that accounts will be locked after a number of failed attempts, instead of saying whether it is locked or not.

So while a successful attempt will seem to have an invalid username or password suggestion after the account is locked
m.de.rooy 2018-10-29 08:57:20 UTC Attachment #81403 Attachment is obsolete 0 1
m.de.rooy 2018-10-29 09:07:59 UTC Status Passed QA Pushed to Master
m.de.rooy 2018-10-29 09:10:31 UTC Keywords release-notes-needed
martin.renvoize 2018-11-08 15:33:38 UTC Status Pushed to Master Pushed to Stable
fridolin.somers 2018-11-28 10:37:38 UTC Resolution --- FIXED
Status Pushed to Stable RESOLVED
jonathan.druart 2019-03-21 16:28:51 UTC Depends on 18314
katrin.fischer 2020-01-06 20:17:14 UTC Status RESOLVED CLOSED
dcook 2020-09-30 08:18:37 UTC CC dcook
katrin.fischer 2020-10-18 17:03:59 UTC See Also https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26727

Back to bug 21311