http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 --- Comment #1 from Galen Charlton <gmcharlt@gmail.com> --- Following up on an observation by Owen Leonard, the template (opac-passwd.tt) does include logic to suppress the form inputs if that system preference is off. That's still not quite good enough -- a user could still supply the form parameters as URL parameters or via a POST and change their password. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 13236 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=13236&action=edit Bug 8515 - OPAC password change does not obey OpacPasswordChange The OPAC change password template enforces the OpacPasswordChange preference by preventing the form from appearing. However, the script doesn't contain any check for OpacPasswordChange so it is vulnerable to someone submitting data to it by some other means. This patch adds a check for OpacPasswordChange to the script and revises the template logic in order to show the right warning in all circumstances. To test, turn off OpacPasswordChange and navigate manually to opac-passwd.pl. You should see a warning that you can't change your password. Turn on OpacPasswordChange load the change password page and save the page to your desktop. Turn off OpacPasswordChange and submit a password change via the saved page. Without the patch this would result in a password change. After the patch it should not. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 Melia Meggs <melia@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |melia@bywatersolutions.com --- Comment #3 from Melia Meggs <melia@bywatersolutions.com> --- I tried this first on master to see the bug, but I'm not sure I'm doing it right. Here's what I did: 1. Turn off OpacPasswordChange and navigate manually to opac-passwd.pl. I got the warning that I can't change your password. 2. Turn on OpacPasswordChange load the change password page and saved the page to my desktop. 3. Turn off OpacPasswordChange and submit a password change via the saved page. What I thought would happen here is that I'd be able to submit the password anyway, but what actually happened is that I loaded the password change page, typed in a new password, clicked submit, and got this error message (from Chrome, not from Koha): This webpage is not found No webpage was found for the web address: file://localhost/Users/meliameggs/Desktop/passwordchange_files/passwordchange.html Error 6 (net::ERR_FILE_NOT_FOUND): The file or directory could not be found. The same thing happened in Firefox: File not found Firefox can't find the file at /cgi-bin/koha/opac-passwd.pl. Check the file name for capitalization or other typing errors. Check to see if the file was moved, renamed or deleted. So I must not be clever enough to figure out how to change my password when I'm not supposed to - ha! I got the same behavior after applying the patch, so I think someone else may need to test this one. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 --- Comment #5 from Melia Meggs <melia@bywatersolutions.com> --- Ok! I get it now! I changed my password with OPACPasswordChange set to "don't allow" on master. Thanks, Owen. Now to test the patch... -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 Melia Meggs <melia@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #7 from Melia Meggs <melia@bywatersolutions.com> --- It works! After applying the patch, I got a "You can't change your password" message. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #13313|0 |1 is obsolete| | --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 13657 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=13657&action=edit [SIGNED-OFF] Bug 8515 - OPAC password change does not obey OpacPasswordChange The OPAC change password template enforces the OpacPasswordChange preference by preventing the form from appearing. However, the script doesn't contain any check for OpacPasswordChange so it is vulnerable to someone submitting data to it by some other means. This patch adds a check for OpacPasswordChange to the script and revises the template logic in order to show the right warning in all circumstances. To test, turn off OpacPasswordChange and navigate manually to opac-passwd.pl. You should see a warning that you can't change your password. Turn on OpacPasswordChange load the change password page and save the page to your desktop. Turn off OpacPasswordChange and submit a password change via the saved page. Without the patch this would result in a password change. After the patch it should not. Signed-off-by: Melia Meggs <melia@test.bywatersolutions.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Confirmed bug and made sure patch fixes it. Passes all tests and perlcritic. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |jcamins@cpbibliography.com --- Comment #9 from Jared Camins-Esakov <jcamins@cpbibliography.com> --- This patch has been pushed to master. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8515 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|3.10 |3.8 --- Comment #11 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.8.x will be in 3.8.8 -- You are receiving this mail because: You are watching all bug changes.