September 2020 - Koha-bugs - lists.koha-community.org

[Bug 12617] Koha should let admins to configure automatically generated password complexity/difficulty
by bugzilla-daemon＠bugs.koha-community.org 30 Sep '20

30 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12617 --- Comment #20 from David Cook <dcook(a)prosentient.com.au> --- Ok because I'm insufferable... The following passes: <html> <head> <script> var min_lenght = 3; var regex_text = "(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%\^&*(){}[\\]<>?/|\-]).{"+min_lenght+",}"; var pattern_regex = new RegExp(regex_text); var output = pattern_regex.test("Aa1!"); alert(output); </script> </head> </html> The following fails: <html> <head> <script> var min_lenght = 3; var regex_text = "(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%\^&*(){}[\\]<>?/|\-]).{"+min_lenght+",}"; var pattern_regex = new RegExp(regex_text); var output = pattern_regex.test("Ää1!"); alert(output); </script> </head> </html> That's not good. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12617] Koha should let admins to configure automatically generated password complexity/difficulty
by bugzilla-daemon＠bugs.koha-community.org 30 Sep '20

30 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12617 --- Comment #19 from David Cook <dcook(a)prosentient.com.au> --- Comment on attachment 110528 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=110528 Bug 12617: Add new regex patterns to password_check.inc Review of attachment 110528: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=126…) ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc @@ +13,5 @@ > > if(category_selector && $('select'+category_selector).length) { > jQuery.validator.addMethod("password_strong", function(value, element){ > var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong'); > var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength'); Btw this should be min_length, although it does look like you've used the misspelled variable consistently... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12617] Koha should let admins to configure automatically generated password complexity/difficulty
by bugzilla-daemon＠bugs.koha-community.org 30 Sep '20

30 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12617 --- Comment #18 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin SOMERS from comment #16) > > However Javascript doesn't seem to support POSIX > Ah ok good point. > > But why are öäåÄÖÅ not in : > if ( password_policy == 'complex' ){ > chars = > '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ|[]{}! > @#$%^&*()_-+?'; > > In my opinion, for a heavy international software like Koha you may stick to > [a-zA-Z] as the only alphabetic characters. > > Or create lang-based policies complex-en, complex-fi ... Based on my earlier comment, especially regarding Red Hat's Keycloak password policies, I think that limiting to '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ|[]{}!@#$%^&*()_-+?' might not be wise for a "complex" policy. Look at pam_cracklib too which is used by massive international Linux providers (https://linux.die.net/man/8/pam_cracklib and https://github.com/linux-pam/linux-pam/blob/master/modules/pam_cracklib/pam…) There complexity is determined by "minlen, maxclassrepeat, dcredit, ucredit, lcredit, and ocredit". Looking at https://github.com/linux-pam/linux-pam/blob/master/modules/pam_cracklib/pam…, it looks like the ctype library includes functions for isupper, islower, isdigit, etc. "ocredit" for "other characters" is just whatever isn't a digit, uppercase letter, or lowercase letter. The Javascript would be more verbose, but it should be doable using a similar algorithm. Chinese is probably still an issue if your password policy has uppercase and lowercase requirements, but that's probably why there are so many Chinese ASCII passwords as per my previous post, but Latin characters with diacritics should be fine using this kind of complexity. But... that's just my 2 cents. I'm not the one writing this patch. I also haven't extensively tested it, so maybe I'm missing the current point of the conversaton. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12617] Koha should let admins to configure automatically generated password complexity/difficulty
by bugzilla-daemon＠bugs.koha-community.org 30 Sep '20

30 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12617 --- Comment #17 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin SOMERS from comment #16) > > However Javascript doesn't seem to support POSIX > Ah ok good point. > > But why are öäåÄÖÅ not in : > if ( password_policy == 'complex' ){ > chars = > '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ|[]{}! > @#$%^&*()_-+?'; > > In my opinion, for a heavy international software like Koha you may stick to > [a-zA-Z] as the only alphabetic characters. > > Or create lang-based policies complex-en, complex-fi ... I think the default with password managers tend to be printable ASCII characters (ie: Upper-case, Lower-case, Digits, Special). That said, I have seen "High ANSI characters" as an option... But then I thought about Chinese password habits (https://medium.com/@ye.sunnia/an-analysis-of-chinese-passwords-e49b97b91919 or https://www.theverge.com/tldr/2019/3/5/18252150/bad-password-security-data-…) which seem to fall into ASCII. I just spun up a Keycloak container (an Identity Provider created by Red Hat), and I'm trying to reset my password (as a user) to a Chinese password in Windows Chrome, but it seems to be preventing my software-based pinyin input from working. It seems to be forcing my hardware keyboard. (Like if I type in "wo", I see 2 masked characters appearing in the password field, rather than being able to select the 1 我 character.) That said, as a Keycloak admin, I was able to input a 我 character into the user's password field. I wasn't able to manually enter it as a user, but if I copied and pasted 我 into the password field as a user, it worked. Going back to the user view, I notice when I move from the username field to the password field, my software keyboard changes modes from Chinese mode to English mode. If manually change the mode... it doesn't seem to make a difference. Here's some reading on Keycloak password policies: https://www.keycloak.org/docs/latest/server_admin/#password-policy-types, which might be useful. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26575] New: "New child record" doesn't know about 264 (RDA) yet
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '20

29 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26575 Bug ID: 26575 Summary: "New child record" doesn't know about 264 (RDA) yet Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl When there is no 260 in the record, we should also check for information in 264 and use this instead when creating a new record using the "New child record" functionality. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 26574] New: Cataloging plugin marc21_linking_section.pl doesn't support 264 (RDA) yet
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '20

29 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26574 Bug ID: 26574 Summary: Cataloging plugin marc21_linking_section.pl doesn't support 264 (RDA) yet Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl The cataloguing plugin marc21_linking_section.pl doesn't support 264 yet, but only copies information from 260. We should check for 264 when 260 is not found. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 11299] Add a button to automatically link authority records in cataloguing (AJAX)
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '20

29 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11299 --- Comment #155 from Michal Denar <black23(a)gmail.com> --- Hi Nick, maybe this video helps: https://recordit.co/HZnnGOsfHD Thank you -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26560] New: Perl Modules Missing
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '20

29 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26560 Bug ID: 26560 Summary: Perl Modules Missing Change sponsored?: --- Product: Koha Version: 20.05 Hardware: All OS: All Status: NEW Severity: new feature Priority: P5 - low Component: Installation and upgrade (command-line installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: dhanabalnet(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Hi All I am new to koha..... When i installed koha 20.04 in ubuntu 18.04, i got some error, like, perl modules missing.... How to fix it -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 5158] Koha needs its own cookie, ice cream, and fudge flavors
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '20

29 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5158 --- Comment #14 from Heather <heather_hernandez(a)nps.gov> --- I've adapted Bon Appetit's tasty date-vanilla-filled cinnamon rolls for whole wheat, liquid sweetener (like honey, agave syrup, whatever you like), a lot less steps for what we think are comparable results, and also wrote the recipe out in US as well as metric measurements: http://gnomematter.blogspot.com/2020/06/date-filled-cinnamon-rolls.html -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

1 0

[Bug 24724] New: Add plugin hook for new SQL report export formats
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '20

29 Sep '20

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24724 Bug ID: 24724 Summary: Add plugin hook for new SQL report export formats Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Plugin architecture Assignee: koha-bugs(a)lists.koha-community.org Reporter: pasi.kallinen(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org There should be a plugin hook for adding new SQL report export formats. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 8