Bug 6854 - import_borrowers.pl : Double password encryption on member update if there is no password in the csv and no default password value.
Summary: import_borrowers.pl : Double password encryption on member update if there is...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: rel_3_2
Hardware: All All
: PATCH-Sent (DO NOT USE) critical (vote)
Target Milestone: Oldversions
Assignee: Frédérick Capovilla
QA Contact: Bugs List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-07 18:40 UTC by Frédérick Capovilla
Modified: 2018-12-16 19:34 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Correct a double password encryption problem in import_borrowers.pl (1.38 KB, patch)
2011-09-07 18:40 UTC, Frédérick Capovilla
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 6854: Correct a double password encryption problem in import_borrowers.pl (1.83 KB, patch)
2011-10-20 05:27 UTC, Katrin Fischer
Details | Diff | Splinter Review
testing CSV file (102 bytes, application/octet-stream)
2011-10-26 15:49 UTC, Paul Poulain
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Frédérick Capovilla 2011-09-07 18:40:25 UTC Comment hidden (obsolete)
Comment 1 Jane Wagner 2011-09-08 16:29:29 UTC
I want to confirm that this is the same problem I'm seeing in multiple places (including current head).  If I import a patron .csv file with a limited number of fields, like

cardnumber,surname,branchcode,categorycode,dateexpiry

where the goal is to update a specific field (like expiration date), it is screwing up the password even though the password field is not included in the .csv.

Does that sound like the same problem?
Comment 2 Frédérick Capovilla 2011-09-08 16:34:04 UTC
(In reply to comment #1)
> I want to confirm that this is the same problem I'm seeing in multiple places
> (including current head).  If I import a patron .csv file with a limited number
> of fields, like
> 
> cardnumber,surname,branchcode,categorycode,dateexpiry
> 
> where the goal is to update a specific field (like expiration date), it is
> screwing up the password even though the password field is not included in the
> .csv.
> 
> Does that sound like the same problem?

I confirm, it is the same problem. The already encrypted passwords get encrypted a second time, which makes them unusable.
Comment 3 Katrin Fischer 2011-10-20 05:27:53 UTC
Created attachment 6002 [details] [review]
[SIGNED-OFF] Bug 6854: Correct a double password encryption problem in import_borrowers.pl

When the CSV file has no password column and no default value was set for
the password :
If we try to modify an existing user, the password from the BD is sent
to ModMember, which then encrypts the already-encrypted password a
second time.

http://bugs.koha-community.org/show_bug.cgi?id=6854

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug on current master.
1) Import new patron with password provided
> OPAC login works
2) Overwrite patron record, password provided
> OPAC login works
3) Overwrite patron record, password not provided
Before patch: OPAC login broken, password in database changed
After patch: OPC login works with same password as before
Comment 4 Katrin Fischer 2011-10-20 05:29:44 UTC
I have updated the severity - destroying existing patron passwords seems critical to me.
Comment 5 Ian Walls 2011-10-20 13:12:57 UTC
Simple patch, well tested, fixes a critical login issue.  Marking Passed QA.
Comment 6 Chris Cormack 2011-10-20 15:48:59 UTC
Pushed, please test
Comment 7 Paul Poulain 2011-10-26 15:49:44 UTC
Created attachment 6064 [details]
testing CSV file

This CSV file is helpfull to test the bug is fixed