Bug 12367 - Import patrons still says "MD5 hash"
Summary: Import patrons still says "MD5 hash"
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: master
Hardware: All All
: P5 - low trivial (vote)
Assignee: Magnus Enger
QA Contact: Testopia
URL:
Keywords:
Depends on: 9611
Blocks:
  Show dependency treegraph
 
Reported: 2014-06-05 07:47 UTC by Magnus Enger
Modified: 2015-06-04 23:33 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: String patch
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 12367 - Import patrons still says "MD5 hash" (3.64 KB, patch)
2014-06-05 08:02 UTC, Magnus Enger
Details | Diff | Splinter Review
Bug 12367 - Import patrons still says "MD5 hash" (3.67 KB, patch)
2014-06-06 05:02 UTC, David Cook
Details | Diff | Splinter Review
Bug 12367 - Import patrons still says "MD5 hash" (3.76 KB, patch)
2014-06-06 13:45 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2014-06-05 07:47:33 UTC
The password hashing algorithm was changed in Bug 9611, but on Tools > Import patrons, in the text on the right hand side, it still says:

"'password' should be stored in plaintext, and will be converted to a MD5 hash (if your passwords are already encrypted, talk to your system administrator about options)."

This has no practical effect, of course, but to someone evaluating Koha it might give the false impression that password security is lower than it really is.
Comment 1 Magnus Enger 2014-06-05 08:02:30 UTC Comment hidden (obsolete)
Comment 2 David Cook 2014-06-06 05:02:57 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2014-06-06 13:45:26 UTC
Created attachment 28700 [details] [review]
Bug 12367 - Import patrons still says "MD5 hash"

The password hashing algorithm was changed in Bug 9611,
but on Tools > Import patrons, in the text on the right
hand side, it still says:

"'password' should be stored in plaintext, and will be
converted to a MD5 hash"

This has no practical effect, of course, but to someone
evaluating Koha it might give the false impression that
password security is lower than it really is.

To test:
- Look at Tools > Import patrons and verify that it says
  "a MD5 hash"
- Also look at the help page and see the same text
- Apply the patch
- Check that both the tool and the help now says
  "a Bcrypt hash"

I'll do a patch for the docs too.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Comment 4 Tomás Cohen Arazi 2014-06-21 22:18:36 UTC
Patch pushed to master.

Thanks Magnus!