Bug 21997

Summary: SIP patron information requests can lock patron out of account
Product: Koha Reporter: Kyle M Hall <kyle>
Component: SIP2Assignee: Kyle M Hall <kyle>
Status: CLOSED FIXED QA Contact: Martin Renvoize <martin.renvoize>
Severity: normal    
Priority: P5 - low CC: colin.campbell, david, fridolin.somers, lucas, martin.renvoize, nick
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28822
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 21997 - SIP patron information requests can lock patron out of account
Bug 21997 - SIP patron information requests can lock patron out of account
Bug 21997: Unit tests
Bug 21997 - SIP patron information requests can lock patron out of account
Bug 21997: Unit tests
Bug 21997 - SIP patron information requests can lock patron out of account
Bug 21997: Unit tests
Bug 21997: SIP patron information requests can lock patron out of account

Description Kyle M Hall 2018-12-13 19:56:06 UTC
Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.
Comment 1 Kyle M Hall 2018-12-13 19:59:36 UTC
Created attachment 83183 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!
Comment 2 Charles Farmer 2019-01-18 22:11:07 UTC
Created attachment 84230 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Comment 3 Martin Renvoize 2019-02-08 15:58:09 UTC
Can we have an accompanying test pretty please..

I think there's enough SIP test scaffolding in place to make this viable.

Failing QA
Comment 4 Kyle M Hall 2019-02-11 18:16:54 UTC
Created attachment 84989 [details] [review]
Bug 21997: Unit tests
Comment 5 Kyle M Hall 2019-02-11 18:17:25 UTC
Created attachment 84990 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Comment 6 Kyle M Hall 2019-02-11 18:18:39 UTC
Created attachment 84991 [details] [review]
Bug 21997: Unit tests
Comment 7 Kyle M Hall 2019-02-11 18:18:51 UTC
Created attachment 84992 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Comment 8 Martin Renvoize 2019-02-20 14:11:01 UTC
Awesome, thanks for adding the tests Kyle.. sorry it's taken me a while to get back to it.
Comment 9 Martin Renvoize 2019-02-20 14:14:17 UTC
Created attachment 85360 [details] [review]
Bug 21997: Unit tests

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2019-02-20 14:14:20 UTC
Created attachment 85361 [details] [review]
Bug 21997: SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 11 Martin Renvoize 2019-02-20 14:14:53 UTC
Works for me, no regressions found, passes qa test scripts.. Passing QA
Comment 12 Nick Clemens 2019-02-22 15:06:27 UTC
Awesome work all!

Pushed to master for 19.05
Comment 13 Martin Renvoize 2019-02-26 09:23:48 UTC
Pushed to 18.11.x for 18.11.04
Comment 14 Lucas Gass 2019-03-07 22:43:51 UTC
backported to 18.05.x for 18.05.11