Bug 21997 - SIP patron information requests can lock patron out of account
Summary: SIP patron information requests can lock patron out of account
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Kyle M Hall
QA Contact: Martin Renvoize
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-12-13 19:56 UTC by Kyle M Hall
Modified: 2019-05-27 12:28 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 21997 - SIP patron information requests can lock patron out of account (1.72 KB, patch)
2018-12-13 19:59 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21997 - SIP patron information requests can lock patron out of account (1.75 KB, patch)
2019-01-18 22:11 UTC, Charles Farmer
Details | Diff | Splinter Review
Bug 21997: Unit tests (2.10 KB, patch)
2019-02-11 18:16 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21997 - SIP patron information requests can lock patron out of account (1.78 KB, patch)
2019-02-11 18:17 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21997: Unit tests (1.64 KB, patch)
2019-02-11 18:18 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21997 - SIP patron information requests can lock patron out of account (1.78 KB, patch)
2019-02-11 18:18 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21997: Unit tests (1.69 KB, patch)
2019-02-20 14:14 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 21997: SIP patron information requests can lock patron out of account (1.82 KB, patch)
2019-02-20 14:14 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2018-12-13 19:56:06 UTC
Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.
Comment 1 Kyle M Hall 2018-12-13 19:59:36 UTC
Created attachment 83183 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!
Comment 2 Charles Farmer 2019-01-18 22:11:07 UTC
Created attachment 84230 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Comment 3 Martin Renvoize 2019-02-08 15:58:09 UTC
Can we have an accompanying test pretty please..

I think there's enough SIP test scaffolding in place to make this viable.

Failing QA
Comment 4 Kyle M Hall 2019-02-11 18:16:54 UTC
Created attachment 84989 [details] [review]
Bug 21997: Unit tests
Comment 5 Kyle M Hall 2019-02-11 18:17:25 UTC
Created attachment 84990 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Comment 6 Kyle M Hall 2019-02-11 18:18:39 UTC
Created attachment 84991 [details] [review]
Bug 21997: Unit tests
Comment 7 Kyle M Hall 2019-02-11 18:18:51 UTC
Created attachment 84992 [details] [review]
Bug 21997 - SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Comment 8 Martin Renvoize 2019-02-20 14:11:01 UTC
Awesome, thanks for adding the tests Kyle.. sorry it's taken me a while to get back to it.
Comment 9 Martin Renvoize 2019-02-20 14:14:17 UTC
Created attachment 85360 [details] [review]
Bug 21997: Unit tests

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2019-02-20 14:14:20 UTC
Created attachment 85361 [details] [review]
Bug 21997: SIP patron information requests can lock patron out of account

Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.

Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 11 Martin Renvoize 2019-02-20 14:14:53 UTC
Works for me, no regressions found, passes qa test scripts.. Passing QA
Comment 12 Nick Clemens 2019-02-22 15:06:27 UTC
Awesome work all!

Pushed to master for 19.05
Comment 13 Martin Renvoize 2019-02-26 09:23:48 UTC
Pushed to 18.11.x for 18.11.04
Comment 14 Lucas Gass 2019-03-07 22:43:51 UTC
backported to 18.05.x for 18.05.11