| Summary: | Koha throws an exception when updating a borrower with an insecure password | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> | 
| Component: | Patrons | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> | 
| Status: | CLOSED FIXED | QA Contact: | Josef Moravec <josef.moravec> | 
| Severity: | major | ||
| Priority: | P5 - low | CC: | gmcharlt, josef.moravec, kyle, m.de.rooy, martin.renvoize | 
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 | 
| Patch complexity: | Trivial patch | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: | Circulation function: | ||
| Attachments: | 
              Bug 22253: Check we actually need to update the password
               Bug 22253: Check we actually need to update the password Bug 22253: Check we actually need to update the password  | 
      ||
| 
 
        
          Description
        
        
          Nick Clemens (kidclamp)
        
        
        
        
          2019-01-31 18:57:16 UTC
        
       
    Created attachment 84594 [details] [review] Bug 22253: Check we actually need to update the password This patch makes memberentry.pl check if password needs to be updated before attempting to call set_password. Above this there's a check that won't raise any errors if no password is passed, or the default string (****) is received. So we could reach that line of code with no password, but the code wouldn't check that. To test: - In master, edit any patron without changing the password => FAIL: It raises an exception - Apply this patch - Edit the patron withtout changing the password => SUCCESS: Edit successful - Edit the patron, changing the password - Try to login with the new password => SUCCESS: The password got changed correctly - Sigh off :-D Created attachment 84640 [details] [review] Bug 22253: Check we actually need to update the password This patch makes memberentry.pl check if password needs to be updated before attempting to call set_password. Above this there's a check that won't raise any errors if no password is passed, or the default string (****) is received. So we could reach that line of code with no password, but the code wouldn't check that. To test: - In master, edit any patron without changing the password => FAIL: It raises an exception - Apply this patch - Edit the patron withtout changing the password => SUCCESS: Edit successful - Edit the patron, changing the password - Try to login with the new password => SUCCESS: The password got changed correctly - Sigh off :-D Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 84657 [details] [review] Bug 22253: Check we actually need to update the password This patch makes memberentry.pl check if password needs to be updated before attempting to call set_password. Above this there's a check that won't raise any errors if no password is passed, or the default string (****) is received. So we could reach that line of code with no password, but the code wouldn't check that. To test: - In master, edit any patron without changing the password => FAIL: It raises an exception - Apply this patch - Edit the patron withtout changing the password => SUCCESS: Edit successful - Edit the patron, changing the password - Try to login with the new password => SUCCESS: The password got changed correctly - Sigh off :-D Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Awesome work all! Pushed to master for 19.05 Bug not in 18.11.x series.  |