[Bug 27812] New: Remove the ability to transmit a patron's plain text password over email
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Bug ID: 27812 Summary: Remove the ability to transmit a patron's plain text password over email Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com We should not give libraries the ability to compromise patron accounts, it is considered a huge security issue and nobody in network security would ever recommend allowing passwords to be transmitted in clear text over email. It should simply not be possible to send a patron's password in plain text via email. As such, we should remove this ability from Koha. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #1 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 117395 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=117395&action=edit Bug 27812: Remove the ability to transmit a patron's plain text password over email We should not give libraries the ability to compromise patron accounts, it is considered a huge security issue and nobody in network security would ever recommend allowing passwords to be transmitted in clear text over email. It should simply not be possible to send a patron's password in plain text via email. As such, we should remove this ability from Koha. Test Plan: 1) Apply this patch 2) Create a patron to generate the ACCTDETAILS email 3) Note you can no longer transmit the patron's password in the email -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |17648 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17648 [Bug 17648] ACCTDETAILS notice does not show in notices.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- (In reply to Kyle M Hall from comment #1)
2) Create a patron to generate the ACCTDETAILS email
Under what circumstances is this notice generated? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Owen Leonard from comment #2)
(In reply to Kyle M Hall from comment #1)
2) Create a patron to generate the ACCTDETAILS email
Under what circumstances is this notice generated?
You need to activate AutoEmailOpacUser first (I hope i got that one right). Then when you create the account, you need to fill in: - name - userid - cardnumber - password Before saving for the first time (IIRC). It might be a field too many :) The message doesn't appear in the message queue, so you need a system set up for emailing in order to see this change. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Amit Gupta <amitddng135@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #117395|0 |1 is obsolete| | CC| |amitddng135@gmail.com --- Comment #4 from Amit Gupta <amitddng135@gmail.com> --- Created attachment 118708 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=118708&action=edit Bug 27812: Remove the ability to transmit a patron's plain text password over email Patch looks good and agree with Kyle. Test Plan: 1) Apply this patch 2) Create a patron to generate the ACCTDETAILS email 3) Note you can no longer transmit the patron's password in the email -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Amit Gupta <amitddng135@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 118797 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=118797&action=edit Bug 27812: Remove the ability to transmit a patron's plain text password over email We should not give libraries the ability to compromise patron accounts, it is considered a huge security issue and nobody in network security would ever recommend allowing passwords to be transmitted in clear text over email. It should simply not be possible to send a patron's password in plain text via email. As such, we should remove this ability from Koha. Test Plan: 1) Apply this patch 2) Create a patron to generate the ACCTDETAILS email 3) Note you can no longer transmit the patron's password in the email Signed-off-by: Amit Gupta <amitddng135@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Good call, works as expected. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org Attachment #118708|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- We are removing the password from the notice template for new installations only, for existing installations the generated notices will be "password: ". I don't think we should remove the password key in the controller script. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA --- Comment #8 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Jonathan Druart from comment #7)
We are removing the password from the notice template for new installations only, for existing installations the generated notices will be "password: ". I don't think we should remove the password key in the controller script.
I disagree. This is a security bug. We should not allow patron's security to be compromised in the future just because we've allowed it to be compromised in the past. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #9 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Kyle M Hall from comment #8)
(In reply to Jonathan Druart from comment #7)
We are removing the password from the notice template for new installations only, for existing installations the generated notices will be "password: ". I don't think we should remove the password key in the controller script.
I disagree. This is a security bug. We should not allow patron's security to be compromised in the future just because we've allowed it to be compromised in the past.
Would you like me to add a follow-up to modify the templates in the database? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> ---
Would you like me to add a follow-up to modify the templates in the database?
I think this is meant well but won't really work for translated notices - so we can't really fix this automatically. But I agree with Kyle about the need to remove this 'non-feature', so we just need to figure out how to do it best. - Change the default notice templates - check! - Are we sure we will remove all translated installers? Then they can be ignored. - Deal with existing installations using the feature - Add well visible note to the release notes - Make sure the notices are still processed, just password will not be output - Add a note to the pref? - Remove password from field list to add to a notice template? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Another thing: I believe you currently need to fill in password in order to have the notice generated at all - we should remove that check as well if I am correct. Thinking about this line: https://git.koha-community.org/Koha-community/Koha/src/commit/02d82b142d998f... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #12 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Katrin Fischer from comment #11)
Another thing: I believe you currently need to fill in password in order to have the notice generated at all - we should remove that check as well if I am correct.
Thinking about this line:
https://git.koha-community.org/Koha-community/Koha/src/commit/ 02d82b142d998f1544fbab6e7f35f6f0fceef084/members/memberentry.pl#L468
Good catch! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #13 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 119176 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=119176&action=edit Bug 27812: Don't require password in data to trigger email -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #119176|0 |1 is patch| | Attachment #119176|application/mbox |text/plain mime type| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed Status|Passed QA |In Discussion --- Comment #14 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Katrin Fischer from comment #10)
Would you like me to add a follow-up to modify the templates in the database?
I think this is meant well but won't really work for translated notices - so we can't really fix this automatically.
But I agree with Kyle about the need to remove this 'non-feature', so we just need to figure out how to do it best.
- Change the default notice templates - check! - Are we sure we will remove all translated installers? Then they can be ignored.
We won't remove all the translated installer files for 21.05, and this patch may be backported. We must fix all the .sql files.
- Deal with existing installations using the feature - Add well visible note to the release notes
Indeed.
- Make sure the notices are still processed, just password will not be output - Add a note to the pref? - Remove password from field list to add to a notice template?
And what about a warning during the upgrade process? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_21_11_candidate --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- A little sad this missed release, got out of my view too. Boldly marking it as 21.11 candidate - I really believe this one needs to go. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #16 from David Cook <dcook@prosentient.com.au> --- (In reply to Kyle M Hall from comment #8)
I disagree. This is a security bug. We should not allow patron's security to be compromised in the future just because we've allowed it to be compromised in the past.
+1 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Also made a note about this one on the road map - please add your names so we can sure this makes it into next release together. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Failed QA --- Comment #18 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Existing notice templates still need to be adjusted. If we cannot adjust them (because modified or translated) we should add a warning if "borrowers.password" or "patron.password" exists. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #19 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I actually liked that we triggered on password change.. it meant you could write a notice to warn users than a password change had taken place and that if it wasn't them they should contact the library ;).. I realise that's it's own use case, but it would be nice to somehow account for that somewhere.. perhaps a new notice.. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #20 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Martin Renvoize from comment #19)
I actually liked that we triggered on password change.. it meant you could write a notice to warn users than a password change had taken place and that if it wasn't them they should contact the library ;).. I realise that's it's own use case, but it would be nice to somehow account for that somewhere.. perhaps a new notice..
I don't think this notice triggered on password change - but it's a little hard to tell as it's not in the databases. The only time I got it to sent a notice was when first adding a patron and I believe that's how it's documented as well. But a notice on password change might be a nice addition? Will see if I can revive this one. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_21_11_candidate |rel_22_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |18543 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18543 [Bug 18543] Emails for new patron accounts with the AutoEmailOpacUser preference require to enter password manually -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #21 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I'd really like to see this moving, trying to summarize: 1) Triggering the notice (In reply to Martin Renvoize from comment #19)
I actually liked that we triggered on password change..
I have had another look, I think the change is that now it will trigger when the userid is changed: Before: if ( C4::Context->preference("AutoEmailOpacUser") == 1 && $newdata{'userid'} && $newdata{'password'}) { After: if ( C4::Context->preference("AutoEmailOpacUser") == 1 && $newdata{'userid'}) { This might be out of scope here, but it seems a little odd before and after the patch. We might want to have a more solid way of triggering this. My suggestion would be to match what we have 'on the tin' and what has been the source of a lot of confusion over the years: "Send/Don't send an email to newly created patrons with their account details." * Email when a new user is added/saved. This would also resolve bug 18543 about not being able to send the auto-generated userid. * Email when a librarian triggers the notice. We could add a button to do that. This would also resolve bug 9097. 2) Updating existing notice templates (In reply to Jonathan Druart from comment #18)
Existing notice templates still need to be adjusted. If we cannot adjust them (because modified or translated) we should add a warning if "borrowers.password" or "patron.password" exists.
I think there are possibly too many variations in the templates to auto-update them. Where should we add the warning? System information tab? The database update? 3) Translated installers
We won't remove all the translated installer files for 21.05, and this patch may be backported. We must fix all the .sql files.
True. I could provide a patch for this, but the others are a little too tricky for me. 4) Move notices to message queue This is a totally separate bug, but it will be so great: Once this is in we can move to message_queue and we will exactly know when or when not a notice was sent (bug 17648) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #118797|0 |1 is obsolete| | Attachment #119176|0 |1 is obsolete| | --- Comment #22 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 131166 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131166&action=edit Bug 27812: Remove the ability to transmit a patron's plain text password over email We should not give libraries the ability to compromise patron accounts, it is considered a huge security issue and nobody in network security would ever recommend allowing passwords to be transmitted in clear text over email. It should simply not be possible to send a patron's password in plain text via email. As such, we should remove this ability from Koha. Test Plan: 1) Apply this patch 2) Create a patron to generate the ACCTDETAILS email 3) Note you can no longer transmit the patron's password in the email Signed-off-by: Amit Gupta <amitddng135@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #23 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 131167 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131167&action=edit Bug 27812: Email should send for all new patron as per the syspref description -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #24 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 131168 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131168&action=edit Bug 27812: Add DBRev to warn of the change to the account details notice -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #25 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Oh, I had missed the updates here!! Thx Kyle! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131166|0 |1 is obsolete| | --- Comment #26 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 131194 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131194&action=edit Bug 27812: Remove the ability to transmit a patron's plain text password over email We should not give libraries the ability to compromise patron accounts, it is considered a huge security issue and nobody in network security would never recommend allowing passwords to be transmitted in clear text over email. It should simply not be possible to send a patron's password in plain text via email. As such, we should remove this ability from Koha. Test Plan: 1) Apply this patch 2) Create a patron to generate the ACCTDETAILS email 3) Note you can no longer transmit the patron's password in the email Signed-off-by: Amit Gupta <amitddng135@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131167|0 |1 is obsolete| | --- Comment #27 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 131195 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131195&action=edit Bug 27812: Email should send for all new patron as per the syspref description Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131168|0 |1 is obsolete| | --- Comment #28 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 131196 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131196&action=edit Bug 27812: Add DBRev to warn of the change to the account details notice Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #29 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 131197 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131197&action=edit Bug 27812: (QA follow-up) Fix atomicupdate We removed a bit too much from the skeliton here ;) Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This bugfix/enhancement release notes| |improves the default | |security of Koha by | |removing the pass of the | |plain text password to the | |ACCTDETAILS notice on | |patron creation. | | | |WARNING: | |You will need to update | |your notice template if you | |were relying on | |`<<borrowers.password>>` in | |this notice. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #30 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Right, I think we've all agreed now to keep this bug to scope as a security related issue. The code works as expected and we've agreed that updating the notices isn't reliably possible and so a warning should be used instead. We now have such a warning posted during the database update and added in the 'Text to go in the release notes' field above. As such, with the QA scripts passing and no nasty regressions found I think we can safely mark this PQA.. I will now go and QA the dependant bugs and report a new bug for the 'Your password has been changed' notice I suggested was a good idea here. PQA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |karen@bywatersolutions.com --- Comment #31 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- *** Bug 18543 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #32 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Bug 25936 already records my request for password change notifications :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=25936 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #33 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Note.. I'm almost tempted to just ditch the ACCTDETAILS notice entirely and replace it with a new 'WELCOME' notice instead.. thus making the whole template and translations stuff mute. Especially as the bugs that all hang off this now make the whole feature feel much more like a Welcome Email feature. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #34 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- +1 on the idea of creating a new Welcome Email feature to replace ACCTDETAILS. The current implementation is confusingly limited and inflexible. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Keywords|release-notes-needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30237 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30237 [Bug 30237] Rename and rephrase AutoEmailOpacUser system preference -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|30237 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30237 [Bug 30237] Rename and rephrase AutoEmailOpacUser system preference -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #35 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- See bug 30237 for the rename/rephrase of the feature notice and preference -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |22.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #36 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to master for 22.05, thanks to everybody involved 🦄 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|22.05.00 |22.05.00,21.11.05 released in| | Status|Pushed to master |Pushed to stable --- Comment #37 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to 21.11.x for 21.11.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #38 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Kyle M Hall from comment #37)
Pushed to 21.11.x for 21.11.05
It's a big change for stable - bit worried libraires using the feature might be too surprised it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30442 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30611 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30611 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30611 [Bug 30611] Add ability to send passwordreseturl from the staff client -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_22_05_candidate | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 Hugo Agud <hagud@orex.es> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hagud@orex.es --- Comment #39 from Hugo Agud <hagud@orex.es> --- First library surprised. The accdetail send the password via mail when a new account is created, but instead of plain text they receive the encrypted password I agree to hide the password this way, but perhaps give them a chance of creating a password on they fly? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #40 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Hugo Agud from comment #39)
First library surprised.
The accdetail send the password via mail when a new account is created, but instead of plain text they receive the encrypted password
I agree to hide the password this way, but perhaps give them a chance of creating a password on they fly?
You can add a link to the 'forget-password' URL to the notice, so they can set a new password themselves right away. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27812 --- Comment #41 from David Cook <dcook@prosentient.com.au> --- (In reply to Hugo Agud from comment #39)
The accdetail send the password via mail when a new account is created, but instead of plain text they receive the encrypted password
To nit-pick a little, it's "the password hash" rather than "the encrypted password". I think there's another bug report that removes "borrower.password" from notices as well, since even emailing the password hash is not ideal. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org