Summary: | koha puts default passwords but doesn't tell you what is | ||
---|---|---|---|
Product: | Koha | Reporter: | Fernando L. Canizo <conan> |
Component: | Patrons | Assignee: | Kyle M Hall <kyle.m.hall> |
Status: | CLOSED INVALID | QA Contact: | Bugs List <koha-bugs> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | gmcharlt, nengard |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Fernando L. Canizo
2011-04-20 15:44:54 UTC
The database is actually empty - there is no password generated (that was my understanding) the *** you see is just always there - it's part of the template. Someone else can confirm for me before I close this bug - or change the title to 'password needs template edits' Nicole I don't really like the idea of a default password. People tend to keep passwords like that and never change them. I makes it much easier to hack patron accounts. When you change a password Koha can already generate a new random password in the length specified in the sys prefs. I would like to see Koha generating a password like this one upon saving a patron with an empty password field. Koha can send out this password as a mail to the patron, if the library wants to do this. We already can do this with manually entered passwords. Ideal would be a to create a one time password and force the patron to change it when he logs into the OPAC for the first time. Perhaps these one time passwords should even expire after a given time or be validated by a mail to the patrons email account. (In reply to comment #1) > The database is actually empty - there is no password generated (that was my > understanding) the *** you see is just always there - it's part of the > template. > > Someone else can confirm for me before I close this bug - or change the title > to 'password needs template edits' > > Nicole Maybe I'm looking in the wrong place, I just created a patron named 'haspassword', give him no password in opac login group and it shows this on DB: mysql> select password from borrowers where surname = 'haspassword'; +------------------------+ | password | +------------------------+ | kDPg4wXyR8DDyA0MeEjIsw | +------------------------+ 1 row in set (0.00 sec) (In reply to comment #2) > I don't really like the idea of a default password. People tend to keep > passwords like that and never change them. I makes it much easier to hack > patron accounts. > > When you change a password Koha can already generate a new random password in > the length specified in the sys prefs. I would like to see Koha generating a > password like this one upon saving a patron with an empty password field. > Koha can send out this password as a mail to the patron, if the library wants > to do this. We already can do this with manually entered passwords. > > Ideal would be a to create a one time password and force the patron to change > it when he logs into the OPAC for the first time. Perhaps these one time > passwords should even expire after a given time or be validated by a mail to > the patrons email account. I agree to all: - random one time passwords sent by email - force patrons to change it on first login And we wont need no changes into prefs. |