The intention of the CSRF protection from bug 36192 was that any form that used method="post" would have to have a param named 'op' which started with 'cud-' but the test that verifies they do missed the case of a template with more than one form. Bug 37728 corrects that, but to land, the things that currently fail the test need to be fixed. In opac-password-recovery.tt that's the fairly critical step where the user sets a new password. Luckily, getting there requires the uniqueKey that's sent in the recovery email, and if someone has access to that you've already lost the game, so it's not really a security issue, just something that needs to be fixed.
Created attachment 171296 [details] [review] Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice that there can be more than one form in a template, opac-password-recovery.tt needs to have a param named 'op' which starts with 'cud-' for the form that POSTs the new password. Luckily, testing this doesn't require that you set Koha up to actually send email (though you can), because you can get the link to reset the password by looking at the list of notices sent to the patron in the staff interface: the failure to send notice works just fine. Test plan: 1. There's no behavior change to test, you just need to see that resetting the password still works, so start with the patch applied. 2. Administration - System preferences - change OpacResetPassword to allowed 3. Set a patron so you can use them, which requires that you know the username, and they have an email address. I give Acosta, Edna one of my email addresses, and copy her cardnumber. 4. Open the OPAC, and below the login form click the "Forgot your password?" link 5. Enter the cardnumber for Login and the email you used for Email and click Submit. If you didn't set up sending email, you'll get an error message, but ignore it, not a problem 6. Back in the staff interface, check out to the patron you are using, and on the left sidebar choose Notices and find the Koha password recovery notice and click that linked phrase 7. In the popup with the notice text, open the recovery link in a new tab 8. Following the instructions for the content of a new password, enter one in both fields and click Submit 9 In the success message, click the link to Log in to your account and log in with the new password Sponsored-by: Chetco Community Public Library
Created attachment 171324 [details] [review] Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice that there can be more than one form in a template, opac-password-recovery.tt needs to have a param named 'op' which starts with 'cud-' for the form that POSTs the new password. Luckily, testing this doesn't require that you set Koha up to actually send email (though you can), because you can get the link to reset the password by looking at the list of notices sent to the patron in the staff interface: the failure to send notice works just fine. Test plan: 1. There's no behavior change to test, you just need to see that resetting the password still works, so start with the patch applied. 2. Administration - System preferences - change OpacResetPassword to allowed 3. Set a patron so you can use them, which requires that you know the username, and they have an email address. I give Acosta, Edna one of my email addresses, and copy her cardnumber. 4. Open the OPAC, and below the login form click the "Forgot your password?" link 5. Enter the cardnumber for Login and the email you used for Email and click Submit. If you didn't set up sending email, you'll get an error message, but ignore it, not a problem 6. Back in the staff interface, check out to the patron you are using, and on the left sidebar choose Notices and find the Koha password recovery notice and click that linked phrase 7. In the popup with the notice text, open the recovery link in a new tab 8. Following the instructions for the content of a new password, enter one in both fields and click Submit 9 In the success message, click the link to Log in to your account and log in with the new password Sponsored-by: Chetco Community Public Library Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Created attachment 171544 [details] [review] Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice that there can be more than one form in a template, opac-password-recovery.tt needs to have a param named 'op' which starts with 'cud-' for the form that POSTs the new password. Luckily, testing this doesn't require that you set Koha up to actually send email (though you can), because you can get the link to reset the password by looking at the list of notices sent to the patron in the staff interface: the failure to send notice works just fine. Test plan: 1. There's no behavior change to test, you just need to see that resetting the password still works, so start with the patch applied. 2. Administration - System preferences - change OpacResetPassword to allowed 3. Set a patron so you can use them, which requires that you know the username, and they have an email address. I give Acosta, Edna one of my email addresses, and copy her cardnumber. 4. Open the OPAC, and below the login form click the "Forgot your password?" link 5. Enter the cardnumber for Login and the email you used for Email and click Submit. If you didn't set up sending email, you'll get an error message, but ignore it, not a problem 6. Back in the staff interface, check out to the patron you are using, and on the left sidebar choose Notices and find the Koha password recovery notice and click that linked phrase 7. In the popup with the notice text, open the recovery link in a new tab 8. Following the instructions for the content of a new password, enter one in both fields and click Submit 9 In the success message, click the link to Log in to your account and log in with the new password Sponsored-by: Chetco Community Public Library Signed-off-by: Olivier V <olivier.vezina@inLibro.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Pushed for 24.11! Well done everyone, thank you!
Backported to 24.05.x for upcoming 24.05.06