Summary: | Cannot reach password reset page when password expired | ||
---|---|---|---|
Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
Component: | Authentication | Assignee: | Nick Clemens (kidclamp) <nick> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | andrew, arthur.suzuki, dpavlin, lucas, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
22.11.00, 22.05.06
|
|
Circulation function: | |||
Bug Depends on: | 29924 | ||
Bug Blocks: | 31483 | ||
Attachments: |
Bug 31382: Pass password_has_expired param to templte
Bug 31382: Pass password_has_expired param to templte Bug 31382: Regression tests Bug 31382: Pass password_has_expired param to templte |
Description
Nick Clemens (kidclamp)
2022-08-17 11:08:06 UTC
Created attachment 139249 [details] [review] Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Created attachment 139297 [details] [review] Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org> Created attachment 139302 [details] [review] Bug 31382: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 139303 [details] [review] Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org> Pushed to master for 22.11. Nice work everyone, thanks! Backported to 22.05.x for 22.05.06 depends on password expiration feature not released in 21.11. no need to backport that one for 21.11.x I guess. |