Bug 37887 - OPAC password recovery needs to use a cud- op while POSTing new password
Summary: OPAC password recovery needs to use a cud- op while POSTing new password
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P3 normal
Assignee: Phil Ringnalda
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on: 36192
Blocks: 37728
  Show dependency treegraph
 
Reported: 2024-09-11 03:03 UTC by Phil Ringnalda
Modified: 2024-09-17 08:50 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00
Circulation function:


Attachments
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password (3.55 KB, patch)
2024-09-11 03:39 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password (3.60 KB, patch)
2024-09-11 13:45 UTC, Olivier Vezina
Details | Diff | Splinter Review
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password (3.68 KB, patch)
2024-09-16 13:41 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-09-11 03:03:58 UTC
The intention of the CSRF protection from bug 36192 was that any form that used method="post" would have to have a param named 'op' which started with 'cud-' but the test that verifies they do missed the case of a template with more than one form. Bug 37728 corrects that, but to land, the things that currently fail the test need to be fixed.

In opac-password-recovery.tt that's the fairly critical step where the user sets a new password. Luckily, getting there requires the uniqueKey that's sent in the recovery email, and if someone has access to that you've already lost the game, so it's not really a security issue, just something that needs to be fixed.
Comment 1 Phil Ringnalda 2024-09-11 03:39:20 UTC
Created attachment 171296 [details] [review]
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
that there can be more than one form in a template, opac-password-recovery.tt
needs to have a param named 'op' which starts with 'cud-' for the form that
POSTs the new password.

Luckily, testing this doesn't require that you set Koha up to actually send
email (though you can), because you can get the link to reset the password
by looking at the list of notices sent to the patron in the staff interface:
the failure to send notice works just fine.

Test plan:
 1. There's no behavior change to test, you just need to see that resetting
    the password still works, so start with the patch applied.
 2. Administration - System preferences - change OpacResetPassword to allowed
 3. Set a patron so you can use them, which requires that you know the
    username, and they have an email address. I give Acosta, Edna one of
    my email addresses, and copy her cardnumber.
 4. Open the OPAC, and below the login form click the "Forgot your password?"
    link
 5. Enter the cardnumber for Login and the email you used for Email and
    click Submit. If you didn't set up sending email, you'll get an error
    message, but ignore it, not a problem
 6. Back in the staff interface, check out to the patron you are using, and
    on the left sidebar choose Notices and find the Koha password recovery
    notice and click that linked phrase
 7. In the popup with the notice text, open the recovery link in a new tab
 8. Following the instructions for the content of a new password, enter one
    in both fields and click Submit
 9  In the success message, click the link to Log in to your account and
    log in with the new password

Sponsored-by: Chetco Community Public Library
Comment 2 Olivier Vezina 2024-09-11 13:45:54 UTC
Created attachment 171324 [details] [review]
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
that there can be more than one form in a template, opac-password-recovery.tt
needs to have a param named 'op' which starts with 'cud-' for the form that
POSTs the new password.

Luckily, testing this doesn't require that you set Koha up to actually send
email (though you can), because you can get the link to reset the password
by looking at the list of notices sent to the patron in the staff interface:
the failure to send notice works just fine.

Test plan:
 1. There's no behavior change to test, you just need to see that resetting
    the password still works, so start with the patch applied.
 2. Administration - System preferences - change OpacResetPassword to allowed
 3. Set a patron so you can use them, which requires that you know the
    username, and they have an email address. I give Acosta, Edna one of
    my email addresses, and copy her cardnumber.
 4. Open the OPAC, and below the login form click the "Forgot your password?"
    link
 5. Enter the cardnumber for Login and the email you used for Email and
    click Submit. If you didn't set up sending email, you'll get an error
    message, but ignore it, not a problem
 6. Back in the staff interface, check out to the patron you are using, and
    on the left sidebar choose Notices and find the Koha password recovery
    notice and click that linked phrase
 7. In the popup with the notice text, open the recovery link in a new tab
 8. Following the instructions for the content of a new password, enter one
    in both fields and click Submit
 9  In the success message, click the link to Log in to your account and
    log in with the new password

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Comment 3 Jonathan Druart 2024-09-16 13:41:51 UTC
Created attachment 171544 [details] [review]
Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
that there can be more than one form in a template, opac-password-recovery.tt
needs to have a param named 'op' which starts with 'cud-' for the form that
POSTs the new password.

Luckily, testing this doesn't require that you set Koha up to actually send
email (though you can), because you can get the link to reset the password
by looking at the list of notices sent to the patron in the staff interface:
the failure to send notice works just fine.

Test plan:
 1. There's no behavior change to test, you just need to see that resetting
    the password still works, so start with the patch applied.
 2. Administration - System preferences - change OpacResetPassword to allowed
 3. Set a patron so you can use them, which requires that you know the
    username, and they have an email address. I give Acosta, Edna one of
    my email addresses, and copy her cardnumber.
 4. Open the OPAC, and below the login form click the "Forgot your password?"
    link
 5. Enter the cardnumber for Login and the email you used for Email and
    click Submit. If you didn't set up sending email, you'll get an error
    message, but ignore it, not a problem
 6. Back in the staff interface, check out to the patron you are using, and
    on the left sidebar choose Notices and find the Koha password recovery
    notice and click that linked phrase
 7. In the popup with the notice text, open the recovery link in a new tab
 8. Following the instructions for the content of a new password, enter one
    in both fields and click Submit
 9  In the success message, click the link to Log in to your account and
    log in with the new password

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Katrin Fischer 2024-09-17 08:50:09 UTC
Pushed for 24.11!

Well done everyone, thank you!