| Summary: | Koha throws an exception when updating a borrower with an insecure password | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
| Component: | Patrons | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> |
| Status: | CLOSED FIXED | QA Contact: | Josef Moravec <josef.moravec> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | gmcharlt, josef.moravec, kyle.m.hall, m.de.rooy, martin.renvoize |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 22253: Check we actually need to update the password
Bug 22253: Check we actually need to update the password Bug 22253: Check we actually need to update the password |
||
|
Description
Nick Clemens (kidclamp)
2019-01-31 18:57:16 UTC
Created attachment 84594 [details] [review] Bug 22253: Check we actually need to update the password This patch makes memberentry.pl check if password needs to be updated before attempting to call set_password. Above this there's a check that won't raise any errors if no password is passed, or the default string (****) is received. So we could reach that line of code with no password, but the code wouldn't check that. To test: - In master, edit any patron without changing the password => FAIL: It raises an exception - Apply this patch - Edit the patron withtout changing the password => SUCCESS: Edit successful - Edit the patron, changing the password - Try to login with the new password => SUCCESS: The password got changed correctly - Sigh off :-D Created attachment 84640 [details] [review] Bug 22253: Check we actually need to update the password This patch makes memberentry.pl check if password needs to be updated before attempting to call set_password. Above this there's a check that won't raise any errors if no password is passed, or the default string (****) is received. So we could reach that line of code with no password, but the code wouldn't check that. To test: - In master, edit any patron without changing the password => FAIL: It raises an exception - Apply this patch - Edit the patron withtout changing the password => SUCCESS: Edit successful - Edit the patron, changing the password - Try to login with the new password => SUCCESS: The password got changed correctly - Sigh off :-D Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 84657 [details] [review] Bug 22253: Check we actually need to update the password This patch makes memberentry.pl check if password needs to be updated before attempting to call set_password. Above this there's a check that won't raise any errors if no password is passed, or the default string (****) is received. So we could reach that line of code with no password, but the code wouldn't check that. To test: - In master, edit any patron without changing the password => FAIL: It raises an exception - Apply this patch - Edit the patron withtout changing the password => SUCCESS: Edit successful - Edit the patron, changing the password - Try to login with the new password => SUCCESS: The password got changed correctly - Sigh off :-D Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Awesome work all! Pushed to master for 19.05 Bug not in 18.11.x series. |