Summary: | Possible privacy breach with OPAC password recovery | ||
---|---|---|---|
Product: | Koha | Reporter: | Marc Véron <veron> |
Component: | OPAC | Assignee: | Marc Véron <veron> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | major | ||
Priority: | P5 - low | CC: | chris, fridolin.somers, jonathan.druart, m.de.rooy, mtj, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18616 | ||
Change sponsored?: | --- | Patch complexity: | String patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 8753 | ||
Bug Blocks: | 18956 | ||
Attachments: |
Bug 18653: Possible privacy breach with OPAC password recovery
Bug 18653: Possible privacy breach with OPAC password recovery |
Description
Marc Véron
2017-05-23 05:00:44 UTC
Created attachment 63642 [details] [review] Bug 18653: Possible privacy breach with OPAC password recovery OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like: An email has been sent to "xxx@yyy.zz". Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions. To reproduce: - Enable OPAC password recovery (syspref OpacResetPassword) - 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester - If such account exists, you get to know the related email address This patch removes the email address from the success message. Additionaly, it changes wording to address Bug 18570 ('will be sent' instead of 'has been sent') Created attachment 63657 [details] [review] Bug 18653: Possible privacy breach with OPAC password recovery OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like: An email has been sent to "xxx@yyy.zz". Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions. To reproduce: - Enable OPAC password recovery (syspref OpacResetPassword) - 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester - If such account exists, you get to know the related email address This patch removes the email address from the success message. Additionaly, it changes wording to address Bug 18570 ('will be sent' instead of 'has been sent') Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Simplified the wording. "Will be sent shortly" is used elsewhere too. Marc, do you agree with the changed wording ? (In reply to Marcel de Rooy from comment #3) > Marc, do you agree with the changed wording ? Yes, sure. What about display partially the email address? (In reply to Jonathan Druart from comment #5) > What about display partially the email address? No, we should give no public information about the email address at all. Not sure, can I add related bugs or bugs where that one depends on? Or will that expose the bug? (For example Bug 18616 and Bug 8753) (In reply to Marc Véron from comment #7) > Not sure, can I add related bugs or bugs where that one depends on? Or will > that expose the bug? (For example Bug 18616 and Bug 8753) You can, the info of the bug will be kept hidden. IMO this bug gets some more importance with Bug 18616 - The "Add forgot password link to OPAC" should allow patrons to use their library card number in addition to username. Taking the liberty to promote this trivial security patch to PQA. Pushed to master for 17.11, thanks to everybody involved! Pushed to 17.05.x, will be in 17.05.01 This patch has been pushed to 16.11.x and will be in 16.11.09. Pushed to 16.05.x, for 16.05.15 release |