Bug 41292

Summary: Add "force_password_reset_when_set_by_staff" to the allowed column name list
Product: Koha Reporter: George Williams (NEKLS) <george>
Component: ReportsAssignee: Andrew Fuerste-Henry <andrew>
Status: Pushed to main --- QA Contact: Marcel de Rooy <m.de.rooy>
Severity: normal    
Priority: P5 - low CC: andrew, david, lisette, m.de.rooy, mteal
Version: MainKeywords: Academy
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37508
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33462
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
This adds the force_password_reset_when_set_by_staff field in the categories table to the list of allowed password-related fields that can be used in SQL reports. Currently, this field is treated as containing sensitive password-related data and generates an error when creating a report that uses it.
Version(s) released in:
26.05.00
Circulation function:
Attachments: Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

Description George Williams (NEKLS) 2025-11-24 16:39:26 UTC
Bug 37508 added filters to Koha SQL reports and prevents them from using column names containing sensitive information.  It also created a whitelist of non-sensitive columns that are accidentally blocked by that same filter.

Bug 33462 added categories.force_password_reset_when_set_by_staff as a new column in the database.

categories.force_password_reset_when_set_by_staff contains no sensitive data but is still blocked by the filters created in Bug 37508.  

categories.force_password_reset_when_set_by_staff should be added to the whitelist.
Comment 1 Andrew Fuerste-Henry 2025-12-03 18:21:46 UTC
Created attachment 190128 [details] [review]
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully

While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology
Comment 2 David Nind 2025-12-03 19:56:36 UTC
Created attachment 190130 [details] [review]
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully

While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Marcel de Rooy 2025-12-05 10:36:16 UTC
Created attachment 190201 [details] [review]
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully

While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Lucas Gass (lukeg) 2025-12-17 20:27:01 UTC
Nice work everyone!

Pushed to main for 26.05