| Summary: | Bad or repeated opac-password-recovery attempt crashes on wrong borrowernumber | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
| Component: | Architecture, internals, and plumbing | Assignee: | Marcel de Rooy <m.de.rooy> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | andrew, jonathan.druart, kyle, victor |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
22.05.00,21.11.03,21.05.11
|
|
| Circulation function: | |||
| Attachments: |
Bug 29646: Fix undefined category crash in opac-password-recovery
Bug 29646: Fix undefined category crash in opac-password-recovery |
||
Seems like a hack attempt btw. The regular password recovery should not crash. Created attachment 128270 [details] [review] Bug 29646: Fix undefined category crash in opac-password-recovery The crash is a result of a not found borrower. This is typically a bad or repeated recovery attempt. Test plan: Do a password recovery. Use the mailed URL twice. Without this patch, the second attempt crashes. With this patch, the second attempt shows an error dialog. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Super trivial fix: self signoff Created attachment 129370 [details] [review] Bug 29646: Fix undefined category crash in opac-password-recovery The crash is a result of a not found borrower. This is typically a bad or repeated recovery attempt. Test plan: Do a password recovery. Use the mailed URL twice. Without this patch, the second attempt crashes. With this patch, the second attempt shows an error dialog. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed to master for 22.05, thanks to everybody involved [U+1F984] Pushed to 21.11.x for 21.11.03 Pushed to 21.05.x for 21.05.11 Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed. |
Seeing this in 20.11 but code in master has not changed: Can't call method "category" on an undefined value at /usr/share/koha/opac/opac-password-recovery.pl line 204 eval {...} at /usr/share/koha/opac/opac-password-recovery.pl line 2 CGI::Compile::ROOT::usr_share_koha_opac_opac_2dpassword_2drecovery_2epl::__ANON__('CGI::Compile=HASH(0x56477a9a9208)', '', '/usr/share/koha/opac/opac-password-recovery.pl', '/usr/share/koha/opac', 'ARRAY(0x56477b4391f0)') called at /usr/share/perl5/CGI/Compile.pm line 151 Code looks like: if ( !$borrower_number ) { $errLinkNotValid = 1; } my $borrower = Koha::Patrons->find($borrower_number); $template->param( new_password => 1, email => $email, uniqueKey => $uniqueKey, username => $username, errLinkNotValid => $errLinkNotValid, hasError => ( $errLinkNotValid ? 1 : 0 ), minPasswordLength => $borrower->category->effective_min_password_length, RequireStrongPassword => $borrower->category->effective_require_strong_password If the borrower_number is not found, the $borrower->category crashes.