Bug 29646

Summary: Bad or repeated opac-password-recovery attempt crashes on wrong borrowernumber
Product: Koha Reporter: Marcel de Rooy <m.de.rooy>
Component: Architecture, internals, and plumbingAssignee: Marcel de Rooy <m.de.rooy>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: andrewfh, jonathan.druart, kyle, victor
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.03,21.05.11
Attachments: Bug 29646: Fix undefined category crash in opac-password-recovery
Bug 29646: Fix undefined category crash in opac-password-recovery

Description Marcel de Rooy 2021-12-06 07:54:17 UTC
Seeing this in 20.11 but code in master has not changed:

Can't call method "category" on an undefined value at /usr/share/koha/opac/opac-password-recovery.pl line 204
        eval {...} at /usr/share/koha/opac/opac-password-recovery.pl line 2
        CGI::Compile::ROOT::usr_share_koha_opac_opac_2dpassword_2drecovery_2epl::__ANON__('CGI::Compile=HASH(0x56477a9a9208)', '', '/usr/share/koha/opac/opac-password-recovery.pl', '/usr/share/koha/opac', 'ARRAY(0x56477b4391f0)') called at /usr/share/perl5/CGI/Compile.pm line 151

Code looks like:
    if ( !$borrower_number ) {
        $errLinkNotValid = 1;
    }
    my $borrower = Koha::Patrons->find($borrower_number);
    $template->param(
        new_password    => 1,
        email           => $email,
        uniqueKey       => $uniqueKey,
        username        => $username,
        errLinkNotValid => $errLinkNotValid,
        hasError        => ( $errLinkNotValid ? 1 : 0 ),
        minPasswordLength => $borrower->category->effective_min_password_length,
        RequireStrongPassword => $borrower->category->effective_require_strong_password

If the borrower_number is not found, the $borrower->category crashes.
Comment 1 Marcel de Rooy 2021-12-06 08:06:11 UTC
Seems like a hack attempt btw. The regular password recovery should not crash.
Comment 2 Marcel de Rooy 2021-12-06 08:34:30 UTC
Created attachment 128270 [details] [review]
Bug 29646: Fix undefined category crash in opac-password-recovery

The crash is a result of a not found borrower. This is typically
a bad or repeated recovery attempt.

Test plan:
Do a password recovery.
Use the mailed URL twice.
Without this patch, the second attempt crashes.
With this patch, the second attempt shows an error dialog.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 3 Marcel de Rooy 2021-12-06 08:35:01 UTC
Super trivial fix: self signoff
Comment 4 Jonathan Druart 2022-01-13 05:35:57 UTC
Created attachment 129370 [details] [review]
Bug 29646: Fix undefined category crash in opac-password-recovery

The crash is a result of a not found borrower. This is typically
a bad or repeated recovery attempt.

Test plan:
Do a password recovery.
Use the mailed URL twice.
Without this patch, the second attempt crashes.
With this patch, the second attempt shows an error dialog.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Fridolin Somers 2022-01-22 07:40:41 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 6 Kyle M Hall 2022-02-07 11:50:39 UTC
Pushed to 21.11.x for 21.11.03
Comment 7 Andrew Fuerste-Henry 2022-02-16 20:52:55 UTC
Pushed to 21.05.x for 21.05.11
Comment 8 Victor Grousset/tuxayo 2022-02-21 08:57:14 UTC
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.