Bug 37887

Summary: OPAC password recovery needs to use a cud- op while POSTing new password
Product: Koha Reporter: Phil Ringnalda <phil>
Component: OPACAssignee: Phil Ringnalda <phil>
Status: Pushed to stable --- QA Contact: Jonathan Druart <jonathan.druart>
Severity: normal    
Priority: P3 CC: lucas, ovezina
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.06
Circulation function:
Bug Depends on: 36192    
Bug Blocks: 37728    
Attachments: Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

Description Phil Ringnalda 2024-09-11 03:03:58 UTC 
The intention of the CSRF protection from bug 36192 was that any form that used method="post" would have to have a param named 'op' which started with 'cud-' but the test that verifies they do missed the case of a template with more than one form. Bug 37728 corrects that, but to land, the things that currently fail the test need to be fixed.

In opac-password-recovery.tt that's the fairly critical step where the user sets a new password. Luckily, getting there requires the uniqueKey that's sent in the recovery email, and if someone has access to that you've already lost the game, so it's not really a security issue, just something that needs to be fixed.
Comment 1 Phil Ringnalda 2024-09-11 03:39:20 UTC 
Created attachment 171296 [details] [review]
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
that there can be more than one form in a template, opac-password-recovery.tt
needs to have a param named 'op' which starts with 'cud-' for the form that
POSTs the new password.

Luckily, testing this doesn't require that you set Koha up to actually send
email (though you can), because you can get the link to reset the password
by looking at the list of notices sent to the patron in the staff interface:
the failure to send notice works just fine.

Test plan:
 1. There's no behavior change to test, you just need to see that resetting
    the password still works, so start with the patch applied.
 2. Administration - System preferences - change OpacResetPassword to allowed
 3. Set a patron so you can use them, which requires that you know the
    username, and they have an email address. I give Acosta, Edna one of
    my email addresses, and copy her cardnumber.
 4. Open the OPAC, and below the login form click the "Forgot your password?"
    link
 5. Enter the cardnumber for Login and the email you used for Email and
    click Submit. If you didn't set up sending email, you'll get an error
    message, but ignore it, not a problem
 6. Back in the staff interface, check out to the patron you are using, and
    on the left sidebar choose Notices and find the Koha password recovery
    notice and click that linked phrase
 7. In the popup with the notice text, open the recovery link in a new tab
 8. Following the instructions for the content of a new password, enter one
    in both fields and click Submit
 9  In the success message, click the link to Log in to your account and
    log in with the new password

Sponsored-by: Chetco Community Public Library
Comment 2 Olivier Vezina 2024-09-11 13:45:54 UTC 
Created attachment 171324 [details] [review]
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
that there can be more than one form in a template, opac-password-recovery.tt
needs to have a param named 'op' which starts with 'cud-' for the form that
POSTs the new password.

Luckily, testing this doesn't require that you set Koha up to actually send
email (though you can), because you can get the link to reset the password
by looking at the list of notices sent to the patron in the staff interface:
the failure to send notice works just fine.

Test plan:
 1. There's no behavior change to test, you just need to see that resetting
    the password still works, so start with the patch applied.
 2. Administration - System preferences - change OpacResetPassword to allowed
 3. Set a patron so you can use them, which requires that you know the
    username, and they have an email address. I give Acosta, Edna one of
    my email addresses, and copy her cardnumber.
 4. Open the OPAC, and below the login form click the "Forgot your password?"
    link
 5. Enter the cardnumber for Login and the email you used for Email and
    click Submit. If you didn't set up sending email, you'll get an error
    message, but ignore it, not a problem
 6. Back in the staff interface, check out to the patron you are using, and
    on the left sidebar choose Notices and find the Koha password recovery
    notice and click that linked phrase
 7. In the popup with the notice text, open the recovery link in a new tab
 8. Following the instructions for the content of a new password, enter one
    in both fields and click Submit
 9  In the success message, click the link to Log in to your account and
    log in with the new password

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Comment 3 Jonathan Druart 2024-09-16 13:41:51 UTC 
Created attachment 171544 [details] [review]
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
that there can be more than one form in a template, opac-password-recovery.tt
needs to have a param named 'op' which starts with 'cud-' for the form that
POSTs the new password.

Luckily, testing this doesn't require that you set Koha up to actually send
email (though you can), because you can get the link to reset the password
by looking at the list of notices sent to the patron in the staff interface:
the failure to send notice works just fine.

Test plan:
 1. There's no behavior change to test, you just need to see that resetting
    the password still works, so start with the patch applied.
 2. Administration - System preferences - change OpacResetPassword to allowed
 3. Set a patron so you can use them, which requires that you know the
    username, and they have an email address. I give Acosta, Edna one of
    my email addresses, and copy her cardnumber.
 4. Open the OPAC, and below the login form click the "Forgot your password?"
    link
 5. Enter the cardnumber for Login and the email you used for Email and
    click Submit. If you didn't set up sending email, you'll get an error
    message, but ignore it, not a problem
 6. Back in the staff interface, check out to the patron you are using, and
    on the left sidebar choose Notices and find the Koha password recovery
    notice and click that linked phrase
 7. In the popup with the notice text, open the recovery link in a new tab
 8. Following the instructions for the content of a new password, enter one
    in both fields and click Submit
 9  In the success message, click the link to Log in to your account and
    log in with the new password

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Katrin Fischer 2024-09-17 08:50:09 UTC 
Pushed for 24.11!

Well done everyone, thank you!
Comment 5 Lucas Gass (lukeg) 2024-11-18 22:04:05 UTC 
Backported to 24.05.x for upcoming 24.05.06