[Bug 20804] New: Sanitize input of timeout syspref
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Bug ID: 20804 Summary: Sanitize input of timeout syspref Change sponsored?: --- Product: Koha Version: 17.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: System Administration Assignee: koha-bugs@lists.koha-community.org Reporter: pablo.bianchi@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com I naively change timeout syspref from default "1d" to "2h". I get logout immediatly, and after login again, at the first clic I was logged out again, with any user, even with koha_instance. plack-error.log Use of uninitialized value $lasttime in numeric lt (<) at /usr/share/koha/lib/C4/Auth.pm line 1425. Argument "2h" isn't numeric in subtraction (-) at /usr/share/koha/lib/C4/Auth.pm line 1425. Argument "2h" isn't numeric in subtraction (-) at /usr/share/koha/lib/C4/Auth.pm line 862. I was back again with via sql update (value='1d') and flushing memcached. I suggest: - Don't been possible to input an invalid input on timeout (well, on any, but for the moment on this one). m/^[0-9]*[dD]?$/ - This syspref (maybe others also) shouldn't apply to koha_instance user (God shouldn't be able to microwave a burrito so hot he himself couldn't eat it). Would be great 30m and 2h for minutes and hours, but that should be other bug. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|17.11 |master CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 107587 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=107587&action=edit Bug 20804: Add tests -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 107588 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=107588&action=edit Bug 20804: Add support for "days" to the timeout syspref If the timeout syspref did not contain an integer, or was not matching integer.'d|D', then it "fallback" to 0 We can easily add support for hours and fallback to 600 if the value is not correct. It will prevent the session to timeout immediately Test plan: 0. Do not apply the patches 1. Fill the timeout syspref with "5m" 2. Login 3. Click somewhere => Notice that the session timed out 4. Apply the patches, restart_all 5. Login 6. Click somewhere => You have 5 minutes to enjoy Koha 7. Fill the pref with an incorrect value ("5x" for instance) 8. Logout, login 9. There is a warning in the log, and you have 10 minutes to enjoy Koha -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Ivan Dziuba <ivan.dziuba@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ivan.dziuba@inlibro.com Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Needs Signoff --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Ivan, you modified the status but there is no signed off patches attached. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #4 from Fridolin SOMERS <fridolin.somers@biblibre.com> ---
1. Fill the timeout syspref with "5m" But minutes are not supported, only days and hours.
-- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 --- Comment #5 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Also if invalid value, warn will be logged at each page. I'd say we better tell default behavior in system preference description. Also add in the description you can use h/H for hours. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #107588|0 |1 is obsolete| | --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 109688 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=109688&action=edit Bug 20804: Add support for "days" to the timeout syspref If the timeout syspref did not contain an integer, or was not matching integer.'d|D', then it "fallback" to 0 We can easily add support for hours and fallback to 600 if the value is not correct. It will prevent the session to timeout immediately Test plan: 0. Do not apply the patches 1. Fill the timeout syspref with "5h" 2. Login 3. Click somewhere => Notice that the session timed out 4. Apply the patches, restart_all 5. Login 6. Click somewhere => You have 5 hours to enjoy Koha 7. Fill the pref with an incorrect value ("5x" for instance) 8. Logout, login 9. There is a warning in the log, and you have 10 minutes (600 secondes) to enjoy Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Fridolin SOMERS from comment #5)
Also if invalid value, warn will be logged at each page. I'd say we better tell default behavior in system preference description. Also add in the description you can use h/H for hours.
I think we want to be verbose if the value is not correct. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #107587|0 |1 is obsolete| | --- Comment #8 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 111160 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=111160&action=edit Bug 20804: Add tests Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #109688|0 |1 is obsolete| | --- Comment #9 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 111161 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=111161&action=edit Bug 20804: Add support for "days" to the timeout syspref If the timeout syspref did not contain an integer, or was not matching integer.'d|D', then it "fallback" to 0 We can easily add support for hours and fallback to 600 if the value is not correct. It will prevent the session to timeout immediately Test plan: 0. Do not apply the patches 1. Fill the timeout syspref with "5h" 2. Login 3. Click somewhere => Notice that the session timed out 4. Apply the patches, restart_all 5. Login 6. Click somewhere => You have 5 hours to enjoy Koha 7. Fill the pref with an incorrect value ("5x" for instance) 8. Logout, login 9. There is a warning in the log, and you have 10 minutes (600 secondes) to enjoy Koha Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Status|Needs Signoff |Signed Off --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- This works well and I agree with the verbosity of the errors. Signing off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #111160|0 |1 is obsolete| | --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 111547 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=111547&action=edit Bug 20804: Add tests Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #111161|0 |1 is obsolete| | --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 111548 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=111548&action=edit Bug 20804: Add support for "days" to the timeout syspref If the timeout syspref did not contain an integer, or was not matching integer.'d|D', then it "fallback" to 0 We can easily add support for hours and fallback to 600 if the value is not correct. It will prevent the session to timeout immediately Test plan: 0. Do not apply the patches 1. Fill the timeout syspref with "5h" 2. Login 3. Click somewhere => Notice that the session timed out 4. Apply the patches, restart_all 5. Login 6. Click somewhere => You have 5 hours to enjoy Koha 7. Fill the pref with an incorrect value ("5x" for instance) 8. Logout, login 9. There is a warning in the log, and you have 10 minutes (600 secondes) to enjoy Koha Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |20.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 --- Comment #13 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 20.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Pushed to master |Pushed to stable Version(s)|20.11.00 |20.11.00, 20.05.06 released in| | --- Comment #14 from Lucas Gass <lucas@bywatersolutions.com> --- backported to 20.05.x for 20.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aleisha@catalyst.net.nz Status|Pushed to stable |Pushed to oldstable Version(s)|20.11.00, 20.05.06 |20.11.00, 20.05.06, released in| |19.11.12 --- Comment #15 from Aleisha Amohia <aleisha@catalyst.net.nz> --- backported to 19.11.x for 19.11.12 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20804 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |RESOLVED Resolution|--- |FIXED CC| |victor@tuxayo.net --- Comment #16 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Not backported to oldoldstable (19.05.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org