Summary: | OPAC password change does not obey OpacPasswordChange | ||
---|---|---|---|
Product: | Koha | Reporter: | Galen Charlton <gmcharlt> |
Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
Status: | CLOSED FIXED | QA Contact: | Katrin Fischer <katrin.fischer> |
Severity: | normal | ||
Priority: | P5 - low | CC: | chris, jcamins, liz, melia |
Version: | 3.8 | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 8515 - OPAC password change does not obey OpacPasswordChange
[Signed off] Bug 8515 - OPAC password change does not obey OpacPasswordChange [SIGNED-OFF] Bug 8515 - OPAC password change does not obey OpacPasswordChange |
Description
Galen Charlton
2012-07-27 13:49:20 UTC
Following up on an observation by Owen Leonard, the template (opac-passwd.tt) does include logic to suppress the form inputs if that system preference is off. That's still not quite good enough -- a user could still supply the form parameters as URL parameters or via a POST and change their password. Created attachment 13236 [details] [review] Bug 8515 - OPAC password change does not obey OpacPasswordChange The OPAC change password template enforces the OpacPasswordChange preference by preventing the form from appearing. However, the script doesn't contain any check for OpacPasswordChange so it is vulnerable to someone submitting data to it by some other means. This patch adds a check for OpacPasswordChange to the script and revises the template logic in order to show the right warning in all circumstances. To test, turn off OpacPasswordChange and navigate manually to opac-passwd.pl. You should see a warning that you can't change your password. Turn on OpacPasswordChange load the change password page and save the page to your desktop. Turn off OpacPasswordChange and submit a password change via the saved page. Without the patch this would result in a password change. After the patch it should not. I tried this first on master to see the bug, but I'm not sure I'm doing it right. Here's what I did: 1. Turn off OpacPasswordChange and navigate manually to opac-passwd.pl. I got the warning that I can't change your password. 2. Turn on OpacPasswordChange load the change password page and saved the page to my desktop. 3. Turn off OpacPasswordChange and submit a password change via the saved page. What I thought would happen here is that I'd be able to submit the password anyway, but what actually happened is that I loaded the password change page, typed in a new password, clicked submit, and got this error message (from Chrome, not from Koha): This webpage is not found No webpage was found for the web address: file://localhost/Users/meliameggs/Desktop/passwordchange_files/passwordchange.html Error 6 (net::ERR_FILE_NOT_FOUND): The file or directory could not be found. The same thing happened in Firefox: File not found Firefox can't find the file at /cgi-bin/koha/opac-passwd.pl. Check the file name for capitalization or other typing errors. Check to see if the file was moved, renamed or deleted. So I must not be clever enough to figure out how to change my password when I'm not supposed to - ha! I got the same behavior after applying the patch, so I think someone else may need to test this one. (In reply to comment #3) > This webpage is not found > No webpage was found for the web address: > file://localhost/Users/meliameggs/Desktop/passwordchange_files/ > passwordchange.html > Error 6 (net::ERR_FILE_NOT_FOUND): The file or directory could not be found. Yeah, because the saved HTML page doesn't save the full URL to which the form should be submitted. You'd have to look for the password form's <form> tag and add the full URL. It probably has the "action" attribute "/cgi-bin/koha/opac-passwd.pl" Ok! I get it now! I changed my password with OPACPasswordChange set to "don't allow" on master. Thanks, Owen. Now to test the patch... Created attachment 13313 [details] [review] [Signed off] Bug 8515 - OPAC password change does not obey OpacPasswordChange The OPAC change password template enforces the OpacPasswordChange preference by preventing the form from appearing. However, the script doesn't contain any check for OpacPasswordChange so it is vulnerable to someone submitting data to it by some other means. This patch adds a check for OpacPasswordChange to the script and revises the template logic in order to show the right warning in all circumstances. To test, turn off OpacPasswordChange and navigate manually to opac-passwd.pl. You should see a warning that you can't change your password. Turn on OpacPasswordChange load the change password page and save the page to your desktop. Turn off OpacPasswordChange and submit a password change via the saved page. Without the patch this would result in a password change. After the patch it should not. Signed-off-by: Melia Meggs <melia@test.bywatersolutions.com> It works! After applying the patch, I got a "You can't change your password" message. Created attachment 13657 [details] [review] [SIGNED-OFF] Bug 8515 - OPAC password change does not obey OpacPasswordChange The OPAC change password template enforces the OpacPasswordChange preference by preventing the form from appearing. However, the script doesn't contain any check for OpacPasswordChange so it is vulnerable to someone submitting data to it by some other means. This patch adds a check for OpacPasswordChange to the script and revises the template logic in order to show the right warning in all circumstances. To test, turn off OpacPasswordChange and navigate manually to opac-passwd.pl. You should see a warning that you can't change your password. Turn on OpacPasswordChange load the change password page and save the page to your desktop. Turn off OpacPasswordChange and submit a password change via the saved page. Without the patch this would result in a password change. After the patch it should not. Signed-off-by: Melia Meggs <melia@test.bywatersolutions.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Confirmed bug and made sure patch fixes it. Passes all tests and perlcritic. This patch has been pushed to master. Pushed to 3.10.x will be in 3.10.1 Pushed to 3.8.x will be in 3.8.8 Patches do not apply to 3.6.x, please reopen and submit a patch for 3.6.x if necessary. Thanks! |