[Bug 31382] New: Cannot reach password reset page when password expired
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Bug ID: 31382 Summary: Cannot reach password reset page when password expired Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org from commit 6fba85d23bf419516111ff959bb5ab7c67ee6414 Bug 29924: Avoid leaking information on wrong credentials This removed passing the password_has_expired info to the template - so we never get the notice or show the reset link -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |nick@bywatersolutions.com |ity.org | Depends on| |29924 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29924 [Bug 29924] Introduce password expiration to patron categories -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 --- Comment #1 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 139249 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=139249&action=edit Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #139249|0 |1 is obsolete| | --- Comment #2 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 139297 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=139297&action=edit Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Andrew Fuerste-Henry <andrewfh@dubcolib.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrewfh@dubcolib.org Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #139297|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 --- Comment #3 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 139302 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=139302&action=edit Bug 31382: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 139303 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=139303&action=edit Bug 31382: Pass password_has_expired param to templte This patch restores the param, while still leaving the check against invalid login credentials to ensure we don't leak information. To test: 1 - enable EnableExpiredPasswordReset 2 - Edit a patron to set password to expire in the past 3 - Attempt opac login as patron 4 - It fails, but you are redirected to login screen with no info 5 - Apply patch 6 - Attempt login 7 - You are notified password expired and given reset link 8 - Go back to login screen 9 - Login with correct username,, wrong password 10 - You are notified of incorrect credentials, not password expiration Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |22.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 22.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |31483 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31483 [Bug 31483] Minor UI problem in opac-reset-password.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|22.11.00 |22.11.00, 22.05.06 released in| | Status|Pushed to master |Pushed to stable CC| |lucas@bywatersolutions.com --- Comment #6 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 22.05.x for 22.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31382 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arthur.suzuki@biblibre.com Status|Pushed to stable |RESOLVED Resolution|--- |FIXED --- Comment #7 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- depends on password expiration feature not released in 21.11. no need to backport that one for 21.11.x I guess. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org