Bug 18308 - Default value of minPasswordLength should be increased
Summary: Default value of minPasswordLength should be increased
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Target Milestone: ---
Assignee: Hayley Mapley
QA Contact: Katrin Fischer
URL:
Whiteboard:
Keywords:
: 9920 22625 (view as bug list)
Depends on: 22451 19514
Blocks: 18888 21265 22681
  Show dependency treegraph
 
Reported: 2017-03-21 13:18 UTC by Jonathan Druart
Modified: 2019-04-18 15:52 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 18308 - Increased default value of minPasswordValue (1.52 KB, patch)
2017-10-23 09:06 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Followup adding default value to syspref.sql (1.53 KB, patch)
2017-10-23 09:49 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added step to onboarding tool to set minPasswordLength (7.51 KB, patch)
2017-10-23 23:03 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added step to onboarding tool to set minPasswordLength (7.67 KB, patch)
2017-11-23 22:54 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added warning and dialog alert (3.26 KB, patch)
2017-11-23 22:55 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added step to onboarding tool to set minPasswordLength (7.67 KB, patch)
2017-11-23 23:47 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added warning and dialog alert (6.12 KB, patch)
2017-11-23 23:48 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added step to onboarding tool to set minPasswordLength (10.82 KB, patch)
2017-11-24 01:02 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added warning and dialog alert (4.43 KB, patch)
2017-11-24 01:05 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18308 - Added warning and dialog alert (4.58 KB, patch)
2017-12-01 21:02 UTC, Dominic Pichette
Details | Diff | Splinter Review
Bug 18308 - Added step to onboarding tool to set minPasswordLength (10.88 KB, patch)
2017-12-01 21:24 UTC, David Bourgault
Details | Diff | Splinter Review
Bug 18308 - Added warning and dialog alert (4.59 KB, patch)
2017-12-01 21:24 UTC, David Bourgault
Details | Diff | Splinter Review
Bug 18308: (follow up) Changed order of onboarding steps (42.52 KB, patch)
2019-03-27 21:56 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Fixed whitespace for qa tool (849 bytes, patch)
2019-03-27 21:57 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added missing filters (1.38 KB, patch)
2019-03-27 22:19 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added another filter (1.02 KB, patch)
2019-03-28 00:36 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Fixed whitespace and added filters for qa tools (2.71 KB, patch)
2019-03-28 00:41 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308 - Added step to onboarding tool to set minPasswordLength (10.72 KB, patch)
2019-04-02 23:26 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308 - Added warning and dialog alert (4.58 KB, patch)
2019-04-02 23:30 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Fixed onboarding_messages.inc by changing order of statements (1.49 KB, patch)
2019-04-08 22:43 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Fixed issues with onboardingstep6.tt (1.70 KB, patch)
2019-04-09 01:59 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Changed ordering of onboarding steps (42.49 KB, patch)
2019-04-09 02:58 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added missing onboardingstep8.tt (8.93 KB, patch)
2019-04-11 01:29 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added step to onboarding tool to set minPasswordLength (10.72 KB, patch)
2019-04-14 22:15 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added warning and dialog alert (4.53 KB, patch)
2019-04-14 22:16 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added step to onboarding tool to set minPasswordLength (10.72 KB, patch)
2019-04-14 22:23 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added warning and dialog alert (4.53 KB, patch)
2019-04-14 22:23 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt (2.80 KB, patch)
2019-04-14 22:24 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Changed ordering of onboarding steps (51.13 KB, patch)
2019-04-14 22:24 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added missing filter in memberentrygen.tt (1.01 KB, patch)
2019-04-14 22:29 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added step to onboarding tool to set minPasswordLength (10.76 KB, patch)
2019-04-15 14:51 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added warning and dialog alert (4.58 KB, patch)
2019-04-15 14:51 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt (2.85 KB, patch)
2019-04-15 14:51 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Changed ordering of onboarding steps (51.17 KB, patch)
2019-04-15 14:51 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added missing filter in memberentrygen.tt (1.05 KB, patch)
2019-04-15 14:51 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Changed templates to use Asset plugin rather than full path (5.16 KB, patch)
2019-04-17 22:03 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Removed extraneous file (8.92 KB, patch)
2019-04-17 22:41 UTC, Hayley Mapley
Details | Diff | Splinter Review
Bug 18308: Added step to onboarding tool to set minPasswordLength (10.76 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added warning and dialog alert (4.58 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt (2.85 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Changed ordering of onboarding steps (51.07 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added missing filter in memberentrygen.tt (1.05 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Changed templates to use Asset plugin rather than full path (5.16 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Removed extraneous file (8.96 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: (QA follow up) Resolving merge conflict (1.02 KB, patch)
2019-04-18 15:49 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added step to onboarding tool to set minPasswordLength (10.76 KB, patch)
2019-04-18 15:51 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added warning and dialog alert (4.58 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt (2.85 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Changed ordering of onboarding steps (51.07 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Added missing filter in memberentrygen.tt (1.05 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Changed templates to use Asset plugin rather than full path (5.21 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: Removed extraneous file (8.96 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 18308: (QA follow up) Resolving merge conflict (1.02 KB, patch)
2019-04-18 15:52 UTC, Liz Rea
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2017-03-21 13:18:17 UTC
It defaults to 3, should be at least 8 or 10.
Comment 1 Marcel de Rooy 2017-03-21 13:39:00 UTC
Definitely +5 :)
Comment 2 Alex Buckley 2017-10-23 09:06:07 UTC
Created attachment 68374 [details] [review]
Bug 18308 - Increased default value of minPasswordValue

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Ensuring PatronSelfRegistration syspref is enabled, and
PatronSelfRegistationDefaultCategory is set register a patron in the
OPAC with a password of 2 characters and notice that a red message is
displayed informing you that the password must be at least 3 characters

3. Run updatedatabase.pl

4. Repeat step 1 and notice that the password must be 8 characters or
more now

5. Repeat step 2 and notice that the password must be 8 characters or
more now

Sponsored-By: Catalyst IT
Comment 3 Marcel de Rooy 2017-10-23 09:24:49 UTC
How about new installations ?
Comment 4 Alex Buckley 2017-10-23 09:49:55 UTC
Created attachment 68381 [details] [review]
Bug 18308 - Followup adding default value to syspref.sql

Sponsored-By: Catalyst IT
Comment 5 Alex Buckley 2017-10-23 09:51:21 UTC
Oops sorry Marcel, I forgot about new installs. I have attached a followup which has the changed minPasswordLength default value set to 8 in syspref.sql and so it should be run in the installation process
Comment 6 Marcel de Rooy 2017-10-23 12:16:10 UTC
From IRC:

marcelr	alexbuckley: thx for followup on 18308; only problem would be now: do all libraries really want this? devs and admins do, but users..
[11:59]	alexbuckley	hmm it could be included in the onboarding tool so when Koha is being installed the value can be set but have it set to 3 by default in sysprefs.sql?
[12:07]	alexbuckley	what do you think of that for a solution marcelr?
[12:08]	marcelr	i strongly think that it should be 8, but i know there will be resistence
[12:08]	marcelr	onboarding could be a good compromise
[12:09]	marcelr	can we set it to 8 and optionally lower it in onboarding ?
[12:09]	alexbuckley	yeah thats a good idea
[12:10]	marcelr	yes with a little security advertisement
Comment 7 Jonathan Druart 2017-10-23 14:10:25 UTC
I do not think we should update existing installations. However we can raise a warning if < X.
Comment 8 Jonathan Druart 2017-10-23 15:03:28 UTC
*** Bug 9920 has been marked as a duplicate of this bug. ***
Comment 9 Alex Buckley 2017-10-23 23:03:20 UTC
Created attachment 68451 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Sponsored-By: Catalyst IT
Comment 10 Alex Buckley 2017-10-23 23:10:09 UTC
Hi Jonathan and Marcel

Have a look at this patch I have just attached it adds a new step to the onboarding tool to optionally alter the minPasswordLength (with security warning which can be made JS warning if you want me to, at the moment it is HTML) and let me know what you think.

I have removed the atomicupate for altering the default value for existing installations as per Jonathan's comment, and in thiss patch I am setting the default value for new installations to 8 as per Marcel and my irc discussion. 

One thing I haven't done yet is raise a warning for existing installations if the minPasswordLength value is < X
Comment 11 Marcel de Rooy 2017-10-24 13:24:31 UTC
Hi Alex
Please add the warning.
And I would suggest to rebase this one on top of 19514. This currently conflicts.

Marcel
Comment 12 Alex Buckley 2017-11-23 22:54:48 UTC
Created attachment 69318 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Sponsored-By: Catalyst IT
Comment 13 Alex Buckley 2017-11-23 22:55:17 UTC
Created attachment 69319 [details] [review]
Bug 18308 - Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Comment 14 Alex Buckley 2017-11-23 23:47:32 UTC
Created attachment 69320 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Sponsored-By: Catalyst IT
Comment 15 Alex Buckley 2017-11-23 23:48:20 UTC
Created attachment 69321 [details] [review]
Bug 18308 - Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Comment 16 Alex Buckley 2017-11-24 01:02:58 UTC
Created attachment 69323 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT
Comment 17 Alex Buckley 2017-11-24 01:05:37 UTC
Created attachment 69324 [details] [review]
Bug 18308 - Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Comment 18 Dominic Pichette 2017-11-24 21:17:50 UTC
patch failed to install:

Applying: Bug 18308 - Added step to onboarding tool to set minPasswordLength
fatal: sha1 information is lacking or useless (installer/data/mysql/sysprefs.sql).
error: could not build fake ancestor
Patch failed at 0001 Bug 18308 - Added step to onboarding tool to set minPasswordLength
Comment 19 Alex Buckley 2017-11-30 02:00:15 UTC
Hi Dominic 

thanks for testing the patch, can you please try again and apply bug 19514 first.
Comment 20 Dominic Pichette 2017-12-01 21:02:56 UTC
Created attachment 69459 [details] [review]
Bug 18308 - Added warning and dialog alert

Works great if you apply bug 19514 before

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>
Comment 21 David Bourgault 2017-12-01 21:24:07 UTC
Created attachment 69461 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Comment 22 David Bourgault 2017-12-01 21:24:11 UTC
Created attachment 69462 [details] [review]
Bug 18308 - Added warning and dialog alert

Works great if you apply bug 19514 before

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Comment 23 Josef Moravec 2017-12-14 11:21:14 UTC
Comment on attachment 69461 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

Review of attachment 69461 [details] [review]:
-----------------------------------------------------------------

I would like to see the setting of min password length before creating the superlibrarian user account, because now you first use the limit a then set the limit - it is not very logical IMO

::: installer/onboarding.pl
@@ +313,1 @@
>      $template_params->{all_done} = 1;    # If step 5 is complete, we are done!

The comment should be changed too, 5 => 6

::: koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt
@@ +2,5 @@
> +<title>Koha &rsaquo; Web installer &rsaquo;
> +    [% IF all_done %]
> +        Complete
> +    [% ELSE %]
> +        Create circulation rule

Should be "Set minPasswordLength system preference"

@@ +8,5 @@
> +</title>
> +[% INCLUDE 'installer-doc-head-close.inc' %]
> +[% INCLUDE 'validator-strings.inc' %]
> +[% INCLUDE 'installer-strings.inc' %]
> +<script type="text/javascript" src="[% interface %]/[% theme %]/js/onboarding.js"></script>

Javascript should be at the end - see bug 17418

@@ +14,5 @@
> +
> +<body id="installer" class="installer">
> +    <div class="container-fluid">
> +        <div class="row">
> +            <div id="onboarding-step5" class="installer-main col-sm-8 col-sm-offset-2 col-md-8 col-md-offset-2">

This is actually step6
Comment 24 Hayley Mapley 2019-03-27 21:56:31 UTC
Created attachment 87124 [details] [review]
Bug 18308: (follow up) Changed order of onboarding steps

This patch cleans up the previous patches according to comment 23, fixes
various typos, and changes the order of steps in the onboarding so that
the setting of minPasswordLength occurs before the admin password is
set.

Test plan:
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the value from
onboarding
7) Verify that the patron, item type, and circulation rule made in the
onboarding exist in the administration
8) Sign off!

Sponsored-by Catalyst IT
Comment 25 Hayley Mapley 2019-03-27 21:57:23 UTC
Created attachment 87125 [details] [review]
Bug 18308: Fixed whitespace for qa tool

Note: This will still fail qa tool due to 'forbidden' javascript
fullpath and not use of Asset plugin. Asset plugin cannot be used for
onboarding currently.

Sponsored-by: Catalyst IT
Comment 26 Hayley Mapley 2019-03-27 22:19:53 UTC
Created attachment 87126 [details] [review]
Bug 18308: Added missing filters

Sponsored-by: Catalyst IT
Comment 27 Hayley Mapley 2019-03-28 00:36:29 UTC
Created attachment 87128 [details] [review]
Bug 18308: Added another filter

Sponsored-by: Catalyst IT
Comment 28 Hayley Mapley 2019-03-28 00:41:31 UTC
Created attachment 87129 [details] [review]
Bug 18308: Fixed whitespace and added filters for qa tools

Note: This will still fail qa tool due to 'forbidden' javascript
fullpath and not use of Asset plugin. Asset plugin cannot be used for
onboarding currently.

Sponsored-by: Catalyst IT
Comment 29 Hayley Mapley 2019-04-02 23:26:30 UTC
Created attachment 87339 [details] [review]
Bug 18308 - Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

https://bugs.koha-community.org/show_bug.cgi?id=6473

Hayley Mapley: Fixed merge conflicts
Comment 30 Hayley Mapley 2019-04-02 23:30:38 UTC
Created attachment 87340 [details] [review]
Bug 18308 - Added warning and dialog alert

Works great if you apply bug 19514 before

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Comment 31 Hayley Mapley 2019-04-08 21:33:38 UTC
Tried to integrate this with the other onboarding related patches. Had to rebase and reattach the patches. Needs to be tested once again.
Comment 32 Hayley Mapley 2019-04-08 21:49:15 UTC
Obsoleted patches made in changing order of steps due to merge conflicts and rebasing issues. Will continue working on this patch to ensure it can be used as a base for the other onboarding patches.
Comment 33 Hayley Mapley 2019-04-08 22:43:16 UTC
Created attachment 87564 [details] [review]
Bug 18308: Fixed onboarding_messages.inc by changing order of statements

Sponsored-by: catalyst IT
Comment 34 Hayley Mapley 2019-04-09 01:59:50 UTC
Created attachment 87572 [details] [review]
Bug 18308: Fixed issues with onboardingstep6.tt

Page did not load due to incorrect include and misplaced javascript tag
and includes.

Sponsored-by: Catalyst IT
Comment 35 Hayley Mapley 2019-04-09 02:58:34 UTC
Created attachment 87573 [details] [review]
Bug 18308: Changed ordering of onboarding steps

This patch cleans up the previous patches according to comment 23, fixes
various typos, and changes the order of steps in the onboarding so that
the setting of minPasswordLength occurs before the admin password is
set.

Test plan:
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the
    value from onboarding
7) Verify that the patron, item type, and circulation rule
    made in the onboarding exist in the administration
8) Sign off!

Sponsored-by Catalyst IT
Comment 36 Hayley Mapley 2019-04-11 01:29:10 UTC
Created attachment 87747 [details] [review]
Bug 18308: Added missing onboardingstep8.tt

Sponsered-by: Catalyt IT
Comment 37 Hayley Mapley 2019-04-11 04:03:12 UTC
*** Bug 22625 has been marked as a duplicate of this bug. ***
Comment 38 Katrin Fischer 2019-04-12 08:31:56 UTC
Hi Hayley,

can you please fix a few things here?

 FAIL	koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt
   OK	  filters
   FAIL	  forbidden patterns
		forbidden pattern: Do *not* include full path to js files, use the Asset TT plugin (bug 20538) (line 137)
   OK	  git manipulation
   OK	  js_in_body
   OK	  spelling
   OK	  tt_valid
   OK	  valid_template

 FAIL	koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep8.tt
   OK	  filters
   FAIL	  forbidden patterns
		forbidden pattern: Do *not* include full path to js files, use the Asset TT plugin (bug 20538) (line 137)
   OK	  git manipulation
   OK	  js_in_body
   OK	  spelling
   OK	  tt_valid
   OK	  valid_template

 FAIL	koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
   FAIL	  filters
		missing_filter at line 136 (        <p><strong> Warning: </strong> [% passwordwarning %]</p>)
   OK	  forbidden patterns
   OK	  git manipulation
   OK	  js_in_body
   OK	  spelling
   OK	  tt_valid
   OK	  valid_template

If you are using kohadevbox you can run the qa test tools from koha-shell:
qa -c 6 -v 2 

There is also a complaint about the commit messages:

Processing additional checks

	* Commit title does not start with 'Bug XXXXX: ' - df4b236511
	* Commit title does not start with 'Bug XXXXX: ' - a1946b6a31

This can be fixed easiest with: git rebase -i HEAD~6 and then rewording the 2 at the beginning.

Let me know, if I can help more.
Comment 39 Hayley Mapley 2019-04-14 21:17:04 UTC
(In reply to Katrin Fischer from comment #38)
> Hi Hayley,
> 
> can you please fix a few things here?
> 
>  FAIL	koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt
>    OK	  filters
>    FAIL	  forbidden patterns
> 		forbidden pattern: Do *not* include full path to js files, use the Asset
> TT plugin (bug 20538) (line 137)
>    OK	  git manipulation
>    OK	  js_in_body
>    OK	  spelling
>    OK	  tt_valid
>    OK	  valid_template
> 
>  FAIL	koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep8.tt
>    OK	  filters
>    FAIL	  forbidden patterns
> 		forbidden pattern: Do *not* include full path to js files, use the Asset
> TT plugin (bug 20538) (line 137)
>    OK	  git manipulation
>    OK	  js_in_body
>    OK	  spelling
>    OK	  tt_valid
>    OK	  valid_template
> 
>  FAIL	koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>    FAIL	  filters
> 		missing_filter at line 136 (        <p><strong> Warning: </strong> [%
> passwordwarning %]</p>)
>    OK	  forbidden patterns
>    OK	  git manipulation
>    OK	  js_in_body
>    OK	  spelling
>    OK	  tt_valid
>    OK	  valid_template
> 
> If you are using kohadevbox you can run the qa test tools from koha-shell:
> qa -c 6 -v 2 
> 
> There is also a complaint about the commit messages:
> 
> Processing additional checks
> 
> 	* Commit title does not start with 'Bug XXXXX: ' - df4b236511
> 	* Commit title does not start with 'Bug XXXXX: ' - a1946b6a31
> 
> This can be fixed easiest with: git rebase -i HEAD~6 and then rewording the
> 2 at the beginning.
> 
> Let me know, if I can help more.

Hi Katrin,

The missing filter I can definitely add. I normally do run the QA tools before attaching, I must have missed it this time though! Thanks for picking it up. 

The Asset plugin issue is trickier because it does not work with onboarding due to how it retrieves Koha version from the database (or tries to before the database is created). There is a patch that will solve this and allow for Asset to be used in onboarding Bug 22451, but it is not yet pushed to Master, so the full path js is all that can be done for now I think. 

I will reattach once I have reworded the commits and added the missing filter.
Comment 40 Hayley Mapley 2019-04-14 22:15:32 UTC
Created attachment 87959 [details] [review]
Bug 18308: Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

https://bugs.koha-community.org/show_bug.cgi?id=6473
Comment 41 Hayley Mapley 2019-04-14 22:16:03 UTC
Created attachment 87960 [details] [review]
Bug 18308: Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Comment 42 Hayley Mapley 2019-04-14 22:23:04 UTC
Created attachment 87961 [details] [review]
Bug 18308: Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

https://bugs.koha-community.org/show_bug.cgi?id=6473
Comment 43 Hayley Mapley 2019-04-14 22:23:45 UTC
Created attachment 87962 [details] [review]
Bug 18308: Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Comment 44 Hayley Mapley 2019-04-14 22:24:14 UTC
Created attachment 87963 [details] [review]
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt

Sponsored-by: Catalyst IT
Comment 45 Hayley Mapley 2019-04-14 22:24:45 UTC
Created attachment 87964 [details] [review]
Bug 18308: Changed ordering of onboarding steps

This patch cleans up the previous patches according to comment 23, fixes
various typos, and changes the order of steps in the onboarding so that
the setting of minPasswordLength occurs before the admin password is
set.

Test plan:
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the
    value from onboarding
7) Verify that the patron, item type, and circulation rule
    made in the onboarding exist in the administration
8) Sign off!

Sponsored-by Catalyst IT
Comment 46 Hayley Mapley 2019-04-14 22:29:27 UTC
Created attachment 87966 [details] [review]
Bug 18308: Added missing filter in memberentrygen.tt

Test plan:
Apply this patch and check that everything still works.

Sponsored-by: Catalyst IT
Comment 47 Liz Rea 2019-04-15 14:51:12 UTC
Created attachment 88010 [details] [review]
Bug 18308: Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

https://bugs.koha-community.org/show_bug.cgi?id=6473

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 48 Liz Rea 2019-04-15 14:51:16 UTC
Created attachment 88011 [details] [review]
Bug 18308: Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 49 Liz Rea 2019-04-15 14:51:20 UTC
Created attachment 88012 [details] [review]
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 50 Liz Rea 2019-04-15 14:51:25 UTC
Created attachment 88013 [details] [review]
Bug 18308: Changed ordering of onboarding steps

This patch cleans up the previous patches according to comment 23, fixes
various typos, and changes the order of steps in the onboarding so that
the setting of minPasswordLength occurs before the admin password is
set.

Test plan:
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the
    value from onboarding
7) Verify that the patron, item type, and circulation rule
    made in the onboarding exist in the administration
8) Sign off!

Sponsored-by Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 51 Liz Rea 2019-04-15 14:51:29 UTC
Created attachment 88014 [details] [review]
Bug 18308: Added missing filter in memberentrygen.tt

Test plan:
Apply this patch and check that everything still works.

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 52 Katrin Fischer 2019-04-17 06:15:43 UTC
Hi Hayley, can you please rebase? I think the conflict might have been caused by bug 22451 being pushed this week.
Comment 53 Josef Moravec 2019-04-17 06:38:07 UTC
(In reply to Katrin Fischer from comment #52)
> Hi Hayley, can you please rebase? I think the conflict might have been
> caused by bug 22451 being pushed this week.

So now it is possible to use Asset in installer and onboarding templates ;)
Comment 54 Hayley Mapley 2019-04-17 22:03:39 UTC
Created attachment 88242 [details] [review]
Bug 18308: Changed templates to use Asset plugin rather than full path

Test plan:
Same as before

Sponsored-by: Catalyst IT
Comment 55 Hayley Mapley 2019-04-17 22:41:40 UTC
Created attachment 88243 [details] [review]
Bug 18308: Removed extraneous file

Sponsored-by: Catalyst IT
Comment 56 Hayley Mapley 2019-04-17 22:45:16 UTC
Test plan:

0) Apply all patches
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the
    value from onboarding
7) Verify that the patron, item type, and circulation rule
    made in the onboarding exist in the administration
8) Sign off!
Comment 57 Liz Rea 2019-04-18 15:49:05 UTC
Created attachment 88306 [details] [review]
Bug 18308: Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

https://bugs.koha-community.org/show_bug.cgi?id=6473

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 58 Liz Rea 2019-04-18 15:49:15 UTC
Created attachment 88307 [details] [review]
Bug 18308: Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 59 Liz Rea 2019-04-18 15:49:19 UTC
Created attachment 88308 [details] [review]
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 60 Liz Rea 2019-04-18 15:49:23 UTC
Created attachment 88309 [details] [review]
Bug 18308: Changed ordering of onboarding steps

This patch cleans up the previous patches according to comment 23, fixes
various typos, and changes the order of steps in the onboarding so that
the setting of minPasswordLength occurs before the admin password is
set.

Test plan:
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the
    value from onboarding
7) Verify that the patron, item type, and circulation rule
    made in the onboarding exist in the administration
8) Sign off!

Sponsored-by Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 61 Liz Rea 2019-04-18 15:49:27 UTC
Created attachment 88310 [details] [review]
Bug 18308: Added missing filter in memberentrygen.tt

Test plan:
Apply this patch and check that everything still works.

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 62 Liz Rea 2019-04-18 15:49:31 UTC
Created attachment 88311 [details] [review]
Bug 18308: Changed templates to use Asset plugin rather than full path

Test plan:
Same as before

Sponsored-by: Catalyst IT
Comment 63 Liz Rea 2019-04-18 15:49:35 UTC
Created attachment 88312 [details] [review]
Bug 18308: Removed extraneous file

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 64 Liz Rea 2019-04-18 15:49:39 UTC
Created attachment 88313 [details] [review]
Bug 18308: (QA follow up) Resolving merge conflict

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 65 Liz Rea 2019-04-18 15:51:56 UTC
Created attachment 88314 [details] [review]
Bug 18308: Added step to onboarding tool to set minPasswordLength

This patch increases the default minPasswordLength syspref value to 8
characters, for new installations.

The final (6th step) of the onboarding tool is now a password length
page where the default value of 8 can be altered. There is a security warning in red recommending to the user they
keep the minimum length of the password at 8 characters or more.

This patch also removes the atomicupdate .sql file to be run in an update to alter the default
minPasswordLength value for existing Koha installations, based on tester
feedback.

Test plan:
1. Create a patron with a password less than 3 characters in length and
notice that a red message is displayed by the input telling you that the
password must be 3 characters minimum length

2. Query the database "select value from systempreferences where
variable="minPasswordLength"; and notice the value is 3

3. Drop and recreate your database and restart memcached

4. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to create a circulation rule

5. Apply patch

6. Repeat step 3

7. Go through the web installer and onboarding tool. Noticing the last
step of the onboarding tool is to set the minimum password length, the
numerical input element has a default value of 8 and notice that it will
go below 3

8. Repeat step 2 and notice the value is 8

9. In the onboarding tool change the minimum password length value to 7
and submit the form

10. Notice the completed page of the onboarding tool is displayed with
the message that the minimum password length has been set.

11. Repeat step 2 and notice the value is now 7.

12. Try to create a patron in Intranet and OPAC with a password less
than 7 characters and notice that a red message is displayed by the
input telling you that the password must be 7 characters minimum length

Sponsored-By: Catalyst IT

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

https://bugs.koha-community.org/show_bug.cgi?id=6473

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 66 Liz Rea 2019-04-18 15:52:06 UTC
Created attachment 88315 [details] [review]
Bug 18308: Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 67 Liz Rea 2019-04-18 15:52:09 UTC
Created attachment 88316 [details] [review]
Bug 18308: Fixed issues with onboarding_messages.inc and onboardingstep6.tt

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 68 Liz Rea 2019-04-18 15:52:13 UTC
Created attachment 88317 [details] [review]
Bug 18308: Changed ordering of onboarding steps

This patch cleans up the previous patches according to comment 23, fixes
various typos, and changes the order of steps in the onboarding so that
the setting of minPasswordLength occurs before the admin password is
set.

Test plan:
1) Drop and recreate your database, and restart_all
2) Go through installation and onboarding
3) Note that the order of steps
is:
 1 Create a library
 2 Create a ptron category
 3 Create Koha administrator patron
 4 Create a new item type
 5 Create a new circulation rule
 6 Set minPasswordLength syspref/Complete
4) Repeat steps 1 & 2
5) Note that the order of steps is now:
 1 Create a library
 2 Create a patron category
 3 Set minPasswordLength syspref
 4 Create Koha administrator patron
 5 Create a new item type
 6 Create a new circulation rule/Complete
6) Verify that the minPasswordLength syspref is set to the
    value from onboarding
7) Verify that the patron, item type, and circulation rule
    made in the onboarding exist in the administration
8) Sign off!

Sponsored-by Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 69 Liz Rea 2019-04-18 15:52:17 UTC
Created attachment 88318 [details] [review]
Bug 18308: Added missing filter in memberentrygen.tt

Test plan:
Apply this patch and check that everything still works.

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 70 Liz Rea 2019-04-18 15:52:21 UTC
Created attachment 88319 [details] [review]
Bug 18308: Changed templates to use Asset plugin rather than full path

Test plan:
Same as before

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 71 Liz Rea 2019-04-18 15:52:25 UTC
Created attachment 88320 [details] [review]
Bug 18308: Removed extraneous file

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 72 Liz Rea 2019-04-18 15:52:28 UTC
Created attachment 88321 [details] [review]
Bug 18308: (QA follow up) Resolving merge conflict

Signed-off-by: Liz Rea <wizzyrea@gmail.com>