Bug 31382 - Cannot reach password reset page when password expired
Summary: Cannot reach password reset page when password expired
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Nick Clemens
QA Contact: Testopia
URL:
Keywords:
Depends on: 29924
Blocks: 31483
  Show dependency treegraph
 
Reported: 2022-08-17 11:08 UTC by Nick Clemens
Modified: 2022-10-12 15:18 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.11.00, 22.05.06


Attachments
Bug 31382: Pass password_has_expired param to templte (1.46 KB, patch)
2022-08-17 11:12 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 31382: Pass password_has_expired param to templte (1.52 KB, patch)
2022-08-17 14:55 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 31382: Regression tests (2.59 KB, patch)
2022-08-17 18:42 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 31382: Pass password_has_expired param to templte (1.52 KB, patch)
2022-08-17 18:42 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2022-08-17 11:08:06 UTC
from commit 6fba85d23bf419516111ff959bb5ab7c67ee6414

Bug 29924: Avoid leaking information on wrong credentials

This removed passing the password_has_expired info to the template - so we never get the notice or show the reset link
Comment 1 Nick Clemens 2022-08-17 11:12:30 UTC
Created attachment 139249 [details] [review]
Bug 31382: Pass password_has_expired param to templte

This patch restores the param, while still leaving the check against invalid
login credentials to ensure we don't leak information.

To test:
 1 - enable  EnableExpiredPasswordReset
 2 - Edit a patron to set password to expire in the past
 3 - Attempt opac login as patron
 4 - It fails, but you are redirected to login screen with no info
 5 - Apply patch
 6 - Attempt login
 7 - You are notified password expired and given reset link
 8 - Go back to login screen
 9 - Login with correct username,, wrong password
10 - You are notified of incorrect credentials, not password expiration
Comment 2 ByWater Sandboxes 2022-08-17 14:55:53 UTC
Created attachment 139297 [details] [review]
Bug 31382: Pass password_has_expired param to templte

This patch restores the param, while still leaving the check against invalid
login credentials to ensure we don't leak information.

To test:
 1 - enable  EnableExpiredPasswordReset
 2 - Edit a patron to set password to expire in the past
 3 - Attempt opac login as patron
 4 - It fails, but you are redirected to login screen with no info
 5 - Apply patch
 6 - Attempt login
 7 - You are notified password expired and given reset link
 8 - Go back to login screen
 9 - Login with correct username,, wrong password
10 - You are notified of incorrect credentials, not password expiration

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Comment 3 Tomás Cohen Arazi 2022-08-17 18:42:42 UTC
Created attachment 139302 [details] [review]
Bug 31382: Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 4 Tomás Cohen Arazi 2022-08-17 18:42:47 UTC
Created attachment 139303 [details] [review]
Bug 31382: Pass password_has_expired param to templte

This patch restores the param, while still leaving the check against invalid
login credentials to ensure we don't leak information.

To test:
 1 - enable  EnableExpiredPasswordReset
 2 - Edit a patron to set password to expire in the past
 3 - Attempt opac login as patron
 4 - It fails, but you are redirected to login screen with no info
 5 - Apply patch
 6 - Attempt login
 7 - You are notified password expired and given reset link
 8 - Go back to login screen
 9 - Login with correct username,, wrong password
10 - You are notified of incorrect credentials, not password expiration

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Comment 5 Tomás Cohen Arazi 2022-08-17 18:52:59 UTC
Pushed to master for 22.11.

Nice work everyone, thanks!
Comment 6 Lucas Gass 2022-10-03 22:42:58 UTC
Backported to 22.05.x for 22.05.06
Comment 7 Arthur Suzuki 2022-10-12 15:18:48 UTC
depends on password expiration feature not released in 21.11.
no need to backport that one for 21.11.x I guess.