Bug 33352 - Password sent by message (accdetails) without decryption
Summary: Password sent by message (accdetails) without decryption
Status: CLOSED INVALID
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: 21.11
Hardware: Other Linux
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-03-28 18:09 UTC by Pablo Jones
Modified: 2023-12-28 20:42 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Crowdfunding committed: 0
Crowdfunding contact:
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Pablo Jones 2023-03-28 18:09:58 UTC
Hello! I'm using version 21.11 of Koha. In our case, we have user self-registration enabled, and when a user registers, they are automatically sent a Welcome email through Koha messaging. The message includes their account name and password, but the problem is that the password is sent without being encrypted. This did not happen in the previous version. I understand that Koha uses Blowfish encryption. Do you have any idea how to decrypt the password so that it can be displayed?

For example, this is the programmed message (accdetails):

Hello, <<borrowers.firstname>> <<borrowers.surname>>.

Your account has been created in the UNPSJB Library System. Your account details are as follows:

Username: <<borrowers.userid>>
Password: <<borrowers.password>>

The text sent is:

Hello, Ximena Vanina XXXX

Your account has been created in the UNPSJB Library System. Your account details are as follows:

Username: ximenavanina.XXXX
Password: $2a$08$orfJ.jWu.RYvR/nhn.gs1e42FnSnliuLuXmsRG38hTP3irEC5BJUS

Any ideas?
Comment 1 David Cook 2023-03-28 23:24:16 UTC
Blowfish isn't an encryption algorithm; it's a hashing algorithm. It computes data only in one direction. You can't reverse the password hash without trying to hack/crack it.

So the problem here isn't "the password is sent without being [decrypted]". The problem is that the password hash is being sent instead of the cleartext password. However, you shouldn't be sending out cleartext passwords by email.

That's why in Koha 21.11.05, due to bug 27812, you can no longer send out cleartext passwords using ACCTDETAILS.