http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #2 from M. de Rooy <m.de.rooy@rijksmuseum.nl> 2011-12-21 13:01:24 UTC --- (In reply to comment #1)

Removed session logging, no useful information was being stored and was just a liability. Thanks for your patch. I agree that current situation could be unsafe, but I do not agree just removing session log information under the flag of not useful information. It could be useful to know who was logged in at at a certain time. Could you write a follow up that gives me that information in a table? That table could be cleaned up regularly in cleanup_database as has been done for more tables..

-- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz --- Comment #3 from Chris Cormack <chris@bigballofwax.co.nz> 2011-12-22 19:16:27 UTC --- I actually told Duncan to just remove it as it was useless in it's current form and insecure. It won't work with multiple sites on the same machine. I think if people want a follow up putting the information in the DB, they could write that. But I definitely do not think that warrants not stopping the current very insecure practice. So I posit very strongly, that we should accept this patch, then accept a follow up later. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-12-22 19:34:24 UTC --- I was not even aware of those logs and I am not sure anybody is using them. I think security tops a feature that is perhaps not used at all? -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 --- Comment #6 from Frère Sébastien Marie <semarie-koha@latrappe.fr> 2011-12-23 05:38:53 UTC --- M. de Rooy, I agreed with you: know who was logged at specific time is important. It is a security measure (logging auth information). But, I also agreed with Chris Cormack... It is better to remove file logging now, and accept a rewrite later. So, +1 for remove current file logging implementation. Some elements for secure and useful logging: - use syslog (but what is the windows compatibility ?) - use koha logging facility (like for modification of patron, syspref...) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6897|0 |1 is obsolete| | --- Comment #7 from Liz Rea <wizzyrea@gmail.com> 2011-12-30 19:39:39 UTC --- Created attachment 6984 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6984 Bug 6627 [Signed Off] - Update to improve security in specified log files - bug 6627 Signed-off-by: Liz Rea <wizzyrea@gmail.com> Verified sessionlog file is not written to /tmp when patch is applied. Also verified original bug - logging in did in fact log to /tmp. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ian.walls@bywatersolutions. | |com Patch Status|Signed Off |Passed QA --- Comment #8 from Ian Walls <ian.walls@bywatersolutions.com> 2012-01-05 12:58:14 UTC --- I would also agree that security is more important than an uncommonly used "feature". This patch comments out lines rather than deleting them, and sometimes adds returns before prints would otherwise be executed. All in all, this is a safe way of handling this issue until we get a more robust followup to re-enable (or reimplement) the lost logging Passed QA -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 --- Comment #10 from Paul Poulain <paul.poulain@biblibre.com> 2012-01-06 13:35:43 UTC --- The more I think of it, the more I think we should remove and not just comment. And we should also remove sub _session_log ! -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 --- Comment #12 from Chris Cormack <chris@bigballofwax.co.nz> 2012-01-11 18:21:18 UTC --- (In reply to comment #11)

In installer/InstallAuth.pm, the patch comments the line : # open L, ">>/tmp/sessionlog";

but L is used : printf L "%20s from %16s logged out at %30s (manually).\n", $userid, $ip, $time;

I think perl doesn't like it :-/

Ahhh looks like the original patch was, the followup broke it. Paul can you fix your followup please. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 --- Comment #14 from Jonathan Druart <jonathan.druart@biblibre.com> 2012-01-13 09:59:55 UTC --- @Paul: sorry, it's ok in master. But the patch doesn't comment all lines -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6627 Frère Sébastien Marie <semarie-koha@latrappe.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|PATCH-Sent (DO NOT USE) |P1 - high Status|Pushed to Stable |RESOLVED Resolution| |FIXED --- Comment #15 from Frère Sébastien Marie <semarie-koha@latrappe.fr> 2012-02-07 15:12:00 UTC --- Thanks -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.