Bug 29646 - Bad or repeated opac-password-recovery attempt crashes on wrong borrowernumber
Summary: Bad or repeated opac-password-recovery attempt crashes on wrong borrowernumber
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-12-06 07:54 UTC by Marcel de Rooy
Modified: 2022-12-12 21:24 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.03,21.05.11


Attachments
Bug 29646: Fix undefined category crash in opac-password-recovery (1.52 KB, patch)
2021-12-06 08:34 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 29646: Fix undefined category crash in opac-password-recovery (1.55 KB, patch)
2022-01-13 05:35 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2021-12-06 07:54:17 UTC
Seeing this in 20.11 but code in master has not changed:

Can't call method "category" on an undefined value at /usr/share/koha/opac/opac-password-recovery.pl line 204
        eval {...} at /usr/share/koha/opac/opac-password-recovery.pl line 2
        CGI::Compile::ROOT::usr_share_koha_opac_opac_2dpassword_2drecovery_2epl::__ANON__('CGI::Compile=HASH(0x56477a9a9208)', '', '/usr/share/koha/opac/opac-password-recovery.pl', '/usr/share/koha/opac', 'ARRAY(0x56477b4391f0)') called at /usr/share/perl5/CGI/Compile.pm line 151

Code looks like:
    if ( !$borrower_number ) {
        $errLinkNotValid = 1;
    }
    my $borrower = Koha::Patrons->find($borrower_number);
    $template->param(
        new_password    => 1,
        email           => $email,
        uniqueKey       => $uniqueKey,
        username        => $username,
        errLinkNotValid => $errLinkNotValid,
        hasError        => ( $errLinkNotValid ? 1 : 0 ),
        minPasswordLength => $borrower->category->effective_min_password_length,
        RequireStrongPassword => $borrower->category->effective_require_strong_password

If the borrower_number is not found, the $borrower->category crashes.
Comment 1 Marcel de Rooy 2021-12-06 08:06:11 UTC
Seems like a hack attempt btw. The regular password recovery should not crash.
Comment 2 Marcel de Rooy 2021-12-06 08:34:30 UTC
Created attachment 128270 [details] [review]
Bug 29646: Fix undefined category crash in opac-password-recovery

The crash is a result of a not found borrower. This is typically
a bad or repeated recovery attempt.

Test plan:
Do a password recovery.
Use the mailed URL twice.
Without this patch, the second attempt crashes.
With this patch, the second attempt shows an error dialog.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 3 Marcel de Rooy 2021-12-06 08:35:01 UTC
Super trivial fix: self signoff
Comment 4 Jonathan Druart 2022-01-13 05:35:57 UTC
Created attachment 129370 [details] [review]
Bug 29646: Fix undefined category crash in opac-password-recovery

The crash is a result of a not found borrower. This is typically
a bad or repeated recovery attempt.

Test plan:
Do a password recovery.
Use the mailed URL twice.
Without this patch, the second attempt crashes.
With this patch, the second attempt shows an error dialog.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Fridolin Somers 2022-01-22 07:40:41 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 6 Kyle M Hall 2022-02-07 11:50:39 UTC
Pushed to 21.11.x for 21.11.03
Comment 7 Andrew Fuerste-Henry 2022-02-16 20:52:55 UTC
Pushed to 21.05.x for 21.05.11
Comment 8 Victor Grousset/tuxayo 2022-02-21 08:57:14 UTC
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.