Bug 28911 - Bcrypt settings are required for pseudonymization but are not set on upgrade
Summary: Bcrypt settings are required for pseudonymization but are not set on upgrade
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 24151
Blocks:
  Show dependency treegraph
 
Reported: 2021-08-27 13:52 UTC by Nick Clemens
Modified: 2022-12-06 03:11 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Example script for koha-conf.xml fixup (13.12 KB, application/x-perl)
2022-12-01 04:45 UTC, David Cook
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2021-08-27 13:52:38 UTC
Bug 24151 added a way to pseudonymize patron transactions.

It added a new config to koha-conf <bcrypt_settings>

This is added for new installs, but not for upgraded sites, and there are no instructions on the syspref or elsewhere for adding

To recreate:
1 - Spin up a 20.05 (checkout 20.05.x and reset_all in kohadevbox)
2 - Upgrade to master (checkout master, updatedatabase)
3 - Enable pseudonymization 
4 - Attempt a checkout
5 - boom

you can manually add the settings by running the command below:
htpasswd -bnBC 10 "" password | tr -d ':\n' | sed 's/$2y/$2a/'

And pasting the results into <bcrypt_settings> in the config
Comment 1 Jonathan Druart 2021-08-27 15:13:39 UTC
Mason, is it something we could do?
Comment 2 Jonathan Druart 2021-09-20 13:26:03 UTC
See also

1.
  commit 242722e99df77be9ce0e4c6d52ff402e0a77d604
  Bug 17336: Add api_secret_passphrase entry in packages setup

and 2.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998#c6
Comment 3 David Cook 2022-04-04 02:19:02 UTC
Just got stung by this one. 

There are quite a few settings like this I think (e.g. plugin_repos, koha_xslt_security, smtp_server).
Comment 4 David Cook 2022-04-07 00:53:30 UTC
(In reply to David Cook from comment #3)
> Just got stung by this one. 
> 
> There are quite a few settings like this I think (e.g. plugin_repos,
> koha_xslt_security, smtp_server).

I'm writing a local script that fixes up a lot of the missing/bad config. It's not very elegant but I could probably share it once I'm done.
Comment 5 David Cook 2022-04-07 00:56:14 UTC
(In reply to David Cook from comment #4)
> (In reply to David Cook from comment #3)
> > Just got stung by this one. 
> > 
> > There are quite a few settings like this I think (e.g. plugin_repos,
> > koha_xslt_security, smtp_server).
> 
> I'm writing a local script that fixes up a lot of the missing/bad config.
> It's not very elegant but I could probably share it once I'm done.

Basically, I loop through /etc/koha/sites, check each koha-conf.xml, and then re-write it. 

It does pretty well overall. The output of XML::LibXML is quite similar to /etc/koha/koha-conf-site.xml.in. The main difference is a bit of whitespace and self-closing tags in some of the Zebra-specific configuration within <yazgfs>. Zebra seems fine with empty tags and different whitespace, so I'm fairly content. Half-tempted to submit a patch to make the whitespace for /etc/koha/koha-conf-site.xml.in be more in line with the output of XML::LibXML, but I don't know what folk would think of that...
Comment 6 Jonathan Druart 2022-11-29 09:35:39 UTC
(In reply to David Cook from comment #4)
> (In reply to David Cook from comment #3)
> > Just got stung by this one. 
> > 
> > There are quite a few settings like this I think (e.g. plugin_repos,
> > koha_xslt_security, smtp_server).
> 
> I'm writing a local script that fixes up a lot of the missing/bad config.
> It's not very elegant but I could probably share it once I'm done.

Yes please, share it.
Comment 7 David Cook 2022-12-01 04:45:17 UTC
Created attachment 144373 [details]
Example script for koha-conf.xml fixup

This is a script I did that uses a reference koha-conf.xml to update some configuration, or just generates missing config (like bcrypt_settings - including comments)

--

I don't think it's particularly robust, so I wouldn't rely on it. I wrote it for a once-off point in time update. 

But maybe it could inspire someone to write a koha-conf.xml upgrade tool. 

That said, I don't love the idea of automatically upgrading koha-conf.xml. It seems a bit dangerous. Although if a backup mechanism is used (like in my script), then I suppose risk is less as you can always fall back.