Bug 6854

Summary: import_borrowers.pl : Double password encryption on member update if there is no password in the csv and no default password value.
Product: Koha Reporter: Frédérick Capovilla <fcapovilla>
Component: ToolsAssignee: Frédérick Capovilla <fcapovilla>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: critical    
Priority: PATCH-Sent (DO NOT USE) CC: chris, jwagner, katrin.fischer, koha.sekjal, paul.poulain
Version: rel_3_2   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Correct a double password encryption problem in import_borrowers.pl
[SIGNED-OFF] Bug 6854: Correct a double password encryption problem in import_borrowers.pl
testing CSV file

Description Frédérick Capovilla 2011-09-07 18:40:25 UTC Comment hidden (obsolete)
Comment 1 Jane Wagner 2011-09-08 16:29:29 UTC
I want to confirm that this is the same problem I'm seeing in multiple places (including current head).  If I import a patron .csv file with a limited number of fields, like

cardnumber,surname,branchcode,categorycode,dateexpiry

where the goal is to update a specific field (like expiration date), it is screwing up the password even though the password field is not included in the .csv.

Does that sound like the same problem?
Comment 2 Frédérick Capovilla 2011-09-08 16:34:04 UTC
(In reply to comment #1)
> I want to confirm that this is the same problem I'm seeing in multiple places
> (including current head).  If I import a patron .csv file with a limited number
> of fields, like
> 
> cardnumber,surname,branchcode,categorycode,dateexpiry
> 
> where the goal is to update a specific field (like expiration date), it is
> screwing up the password even though the password field is not included in the
> .csv.
> 
> Does that sound like the same problem?

I confirm, it is the same problem. The already encrypted passwords get encrypted a second time, which makes them unusable.
Comment 3 Katrin Fischer 2011-10-20 05:27:53 UTC
Created attachment 6002 [details] [review]
[SIGNED-OFF] Bug 6854: Correct a double password encryption problem in import_borrowers.pl

When the CSV file has no password column and no default value was set for
the password :
If we try to modify an existing user, the password from the BD is sent
to ModMember, which then encrypts the already-encrypted password a
second time.

http://bugs.koha-community.org/show_bug.cgi?id=6854

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug on current master.
1) Import new patron with password provided
> OPAC login works
2) Overwrite patron record, password provided
> OPAC login works
3) Overwrite patron record, password not provided
Before patch: OPAC login broken, password in database changed
After patch: OPC login works with same password as before
Comment 4 Katrin Fischer 2011-10-20 05:29:44 UTC
I have updated the severity - destroying existing patron passwords seems critical to me.
Comment 5 Ian Walls 2011-10-20 13:12:57 UTC
Simple patch, well tested, fixes a critical login issue.  Marking Passed QA.
Comment 6 Chris Cormack 2011-10-20 15:48:59 UTC
Pushed, please test
Comment 7 Paul Poulain 2011-10-26 15:49:44 UTC
Created attachment 6064 [details]
testing CSV file

This CSV file is helpfull to test the bug is fixed