[Bug 29132] New: API access denied after update to 19.11.22 due to not executed atomicupdate for api keys
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Bug ID: 29132 Summary: API access denied after update to 19.11.22 due to not executed atomicupdate for api keys Change sponsored?: --- Product: Koha Version: 19.11 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: alexander.borkowski@kau.se After updating from 19.11.21 to 19.11.22, API access to our Koha instance failed. The reason was that the installer/data/mysql/atomicupdate/bug_28772_api_keys.pl was not executed, likely due to the fact that installer/data/mysql/updatedatabase.pl only executes files that end in .perl or .sql, while the new one ends in .pl. Manually executing the equivalent code (hashing the API-keys) fixes the problem. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #1 from Alexander Borkowski <alexander.borkowski@kau.se> --- Just renaming installer/data/mysql/atomicupdate/bug_28772_api_keys.pl to installer/data/mysql/atomicupdate/bug_28772_api_keys.perl is not enough to fix this. I did that, built local packages and now at least I get "DEV atomic update: bug_28772_api_keys.perl" when I install the updated package, but the API key secrets still remain unhashed. As I wrote earlier extracting the relevant parts from that installer/data/mysql/atomicupdate/bug_28772_api_keys.pl and executing them in a short wrapper script (mainly for getting att C4::Context->dbh) works for me. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com, | |wainuiwitikapark@catalyst.n | |et.nz Depends on| |28772 --- Comment #2 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Wainui, did you see this bug report? You forgot to move the atomicupdate to the updatedatabase.pl script. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28772 [Bug 28772] Any user that can work with reports can see API keys of any other user -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #3 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 127946 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=127946&action=edit Bug 28772: DBRev 19.11.23.001 Note that this added back the following patch: "Bug 28772: Do not hash secrets twice" -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff --- Comment #4 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Wainui, this patch is moving the dbrev to the updatedatabase.pl script. Note that it also added back a commit you reverted. Do you remember why? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Assignee|koha-bugs@lists.koha-commun |jonathan.druart+koha@gmail. |ity.org |com QA Contact| |tomascohen@gmail.com --- Comment #5 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Tomas, can you have a look please? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #127946|0 |1 is obsolete| | --- Comment #6 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 127948 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=127948&action=edit Bug 28772: DBRev 19.11.23.001 Note that this added back the following patch: "Bug 28772: Do not hash secrets twice" https://bugs.koha-community.org/show_bug.cgi?id=29132 Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Tested before the 28772 patches then the upgrade and then this patch. All works as expected. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #8 from wainuiwitikapark@catalyst.net.nz --- Sorry about this everyone, I do not remember why the patch reverted. Thanks so much!! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #127948|0 |1 is obsolete| | --- Comment #9 from wainuiwitikapark@catalyst.net.nz --- Created attachment 127967 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=127967&action=edit Bug 28772: DBRev 19.11.23.001 Note that this added back the following patch: "Bug 28772: Do not hash secrets twice" https://bugs.koha-community.org/show_bug.cgi?id=29132 Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #10 from wainuiwitikapark@catalyst.net.nz --- I have added this patch to the 19.11.x branch, however I am unsure if I should release this this month as it is the only new patch. 19.11.x is LTS, so only really backporting security patches. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #11 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to wainuiwitikapark from comment #10)
I have added this patch to the 19.11.x branch, however I am unsure if I should release this this month as it is the only new patch. 19.11.x is LTS, so only really backporting security patches.
...and important fixes, in my opinion. If a feature got broken, and doesn't introduce new strings, I'd release even out of schedule. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #12 from Fridolin Somers <fridolin.somers@biblibre.com> --- I see the commit has been pushed to 19.11.x I propose we set status to revolved. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Alexander Borkowski <alexander.borkowski@kau.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |RESOLVED Resolution|--- |FIXED --- Comment #13 from Alexander Borkowski <alexander.borkowski@kau.se> --- I built local packages from the latest 19.11.x and installed them on our test server. All works as expected (already hashed secrets remained untouched and plain ones I created for testing where hashed afterwards). Setting status to resolved now - many thanks to all involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |19.11.24 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29132 --- Comment #14 from wainuiwitikapark@catalyst.net.nz --- Cool, yes this will be in 19.11.24. Thanks everyone. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org