Bug 41292 - Add "force_password_reset_when_set_by_staff" to the allowed column name list
Summary: Add "force_password_reset_when_set_by_staff" to the allowed column name list
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Andrew Fuerste-Henry
QA Contact: Marcel de Rooy
URL:
Keywords: Academy
Depends on:
Blocks:
 
Reported: 2025-11-24 16:39 UTC by George Williams (NEKLS)
Modified: 2025-12-17 20:27 UTC (History)
5 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This adds the force_password_reset_when_set_by_staff field in the categories table to the list of allowed password-related fields that can be used in SQL reports. Currently, this field is treated as containing sensitive password-related data and generates an error when creating a report that uses it.
Version(s) released in:
26.05.00
Circulation function:


Attachments
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff (1.95 KB, patch)
2025-12-03 18:21 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff (2.00 KB, patch)
2025-12-03 19:56 UTC, David Nind
Details | Diff | Splinter Review
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff (2.09 KB, patch)
2025-12-05 10:36 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description George Williams (NEKLS) 2025-11-24 16:39:26 UTC
Bug 37508 added filters to Koha SQL reports and prevents them from using column names containing sensitive information.  It also created a whitelist of non-sensitive columns that are accidentally blocked by that same filter.

Bug 33462 added categories.force_password_reset_when_set_by_staff as a new column in the database.

categories.force_password_reset_when_set_by_staff contains no sensitive data but is still blocked by the filters created in Bug 37508.  

categories.force_password_reset_when_set_by_staff should be added to the whitelist.
Comment 1 Andrew Fuerste-Henry 2025-12-03 18:21:46 UTC
Created attachment 190128 [details] [review]
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully

While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology
Comment 2 David Nind 2025-12-03 19:56:36 UTC
Created attachment 190130 [details] [review]
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully

While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Marcel de Rooy 2025-12-05 10:36:16 UTC
Created attachment 190201 [details] [review]
Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff

To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully

While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Lucas Gass (lukeg) 2025-12-17 20:27:01 UTC
Nice work everyone!

Pushed to main for 26.05