Bug 23733 - Password import explodes when password is too 'weak' and doesn't allow empty passwords anymore
Summary: Password import explodes when password is too 'weak' and doesn't allow empty ...
Status: CLOSED WORKSFORME
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-10-03 13:44 UTC by Katrin Fischer
Modified: 2020-11-30 21:45 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2019-10-03 13:44:01 UTC
This appears to be a recent change - the patron import explodes on a password too weak, even as it's not set to overwrite them.

[Password is too weak] at /usr/share/perl5/Exception/Class/Base.pm line 88
Comment 1 Katrin Fischer 2019-10-03 13:47:46 UTC
Addition: I turned off RequireStrongPassword and tried importing an empty password and it also explodes:

Password length (0) is shorter than required (3) at /usr/share/perl5/Exception/Class/Base.pm line 88

There is a use case for importing patrons without a password. Instead of setting some potentially unsafe or unknown default password, you can then have them set their own in the opac using the password reset feature.
Comment 2 Jonathan Druart 2019-10-16 10:41:10 UTC
Should we turn off the password restriction when importing patrons then?
Comment 3 Jonathan Druart 2019-10-16 10:46:53 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2019-10-16 10:47:10 UTC
I do not recreate, could you post a example file to test?
Comment 5 Katrin Fischer 2019-10-16 11:56:40 UTC
I think the real problem is:

- Don't check the password if there is a matching patron and system is set to 'don't overwrite' (but that's kind of a strange edge case)
- Allow empty passwords

We allow empty (no login possible) when adding patrons manually, so this should work for import as well.
Comment 6 Katrin Fischer 2019-10-16 11:58:10 UTC
Sorry, missed the second comment. It appeared when I was testing lately, will check if I still have the file.
Comment 7 Martin Renvoize 2019-11-05 08:24:29 UTC
Isn't this a duplicate of bug 23473 ?
Comment 8 Martin Renvoize 2019-11-05 08:24:49 UTC

*** This bug has been marked as a duplicate of bug 23473 ***
Comment 9 Katrin Fischer 2019-11-05 11:49:32 UTC
No, it's not a duplicate. This is about initial import and a regression, the other is a completely new behaviour.
Comment 10 Katrin Fischer 2019-11-05 11:59:08 UTC
I've retested and it seems better now:

Initial import (new patrons)
cardnumber,surname,userid,categorycode,branchcode,password
test1,Mcknight,test1,YA,SPL,''
test2,Edwards,test2,PT,MPL,

Patrons are imported, only thing I wonder about:
password, userid
! 	test2
$2a$08$.28krH.OYaHspkZ98mTew.MBDYc4ggbgaxslZgBtmlewQ58Xoip.W 	test3

What password has been set for the second patron?

Overwriting them matching on cardnumber also works as expected.

Maybe I was not testing in a clean installation - closing this for now.