[Bug 28998] New: Encrypt borrowers.secret
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Bug ID: 28998 Summary: Encrypt borrowers.secret Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: jonathan.druart+koha@gmail.com QA Contact: testopia@bugs.koha-community.org We don't want the secret to be available from the reports admin and so we must encrypt them. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |28786 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28786 [Bug 28786] Two-factor authentication for staff client - TOTP -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #1 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 124772 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=124772&action=edit Bug 28998: Store encrypted secret -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #2 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 124773 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=124773&action=edit Bug 28998: Add encryption_key to the config file -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #3 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 124774 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=124774&action=edit Bug 28998: Add Crypt::CBC dependency -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |Sponsored-by: Orex Digital release notes| | Change sponsored?|--- |Sponsored -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |jonathan.druart+koha@gmail. |ity.org |com CC| |martin.renvoize@ptfs-europe | |.com, tomascohen@gmail.com --- Comment #4 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- How do we generate the new config entry on upgrade? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- This is looking great.. thanks for taking the time on it.. I'll swing back round to this once I've completed working through the 2FA bug. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- 242722e99df77be9ce0e4c6d52ff402e0a77d604 might help with generating the random key at koha-create.. need to dig out how we did it for upgrades -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=28911 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #7 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- This is what we do with the API secret using Crypt::Eksblowfish::Bcrypt : $self->set( { secret => Koha::AuthUtils::hash_password( $self->{_plain_text_secret} ), client_id => $self->_generate_unused_uuid('client_id'), } Just reading a bit, it seems that AES is preferred over Blowfish. But this is theoretical and about larger texts to encrypt. Since we are only crypting a short secret here, I wonder if we should not stick to Blowfish here and use what we already have instead of yet another module? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #8 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Question: shouldn't we entirely move the 'secret' column to a separate table and add the table to a deny-list? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |BLOCKED --- Comment #9 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Looking here. Might propose some changes? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #7)
Since we are only crypting a short secret here, I wonder if we should not stick to Blowfish here and use what we already have instead of yet another module?
Using Crypt::Eksblowfish is a bit of a pain (you need to chunk yourself, add padding etc.) So just scratch that. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #11 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133291 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133291&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #124772|0 |1 is obsolete| | Attachment #133291|0 |1 is obsolete| | --- Comment #12 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133317 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133317&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [AMENDED] Added copyright line to module. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133318 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133318&action=edit Bug 28998: (follow-up) Add Patron->encode_secret and ->decoded_secret Test plan: Run t/db_dependent/Koha/Patron.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #14 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133319 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133319&action=edit Bug 28998: (follow-up) Apply changes to TwoFactorAuth module and script Test plan: Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Walk thru cycle register - logout/login - deregister - logout/login. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #15 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133320 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133320&action=edit Bug 28998: Adjust Selenium test Test plan: Run t/db_dependent/selenium/authentication_2fa.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #16 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133321 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133321&action=edit Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test This patch can be squashed with the previous one, if all is ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #124773|0 |1 is obsolete| | Attachment #124774|0 |1 is obsolete| | --- Comment #17 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133322 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133322&action=edit Bug 28998: Add encryption_key to the config file Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #18 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133323 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133323&action=edit Bug 28998: Add Crypt::CBC dependency Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #19 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #17)
Created attachment 133322 [details] [review] Bug 28998: Add encryption_key to the config file
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Recently a QAer insisted that I should adjust koha-create when adding koha-conf.xml entries :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|28786 |29894 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28786 [Bug 28786] Two-factor authentication for staff client - TOTP https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29894 [Bug 29894] 2FA: Add few validations, clear secret, send register notice -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Signed Off --- Comment #20 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Reworked this a bit and tested on top of 28786 - 29873 - 29894. Main thing is splitting the first patch and moving some code to Koha::Patron. Taking the liberty to set it to Signed Off with one request: Please run the Selenium test. And if you agree, squash patch 4 and patch 5. If you would not agree, feel free to change status and tell me about it :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net Patch complexity|--- |Medium patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133317|0 |1 is obsolete| | --- Comment #21 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133523 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133523&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [AMENDED] Added copyright line to module. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133318|0 |1 is obsolete| | --- Comment #22 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133524 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133524&action=edit Bug 28998: (follow-up) Add Patron->encode_secret and ->decoded_secret Test plan: Run t/db_dependent/Koha/Patron.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133319|0 |1 is obsolete| | --- Comment #23 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133525 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133525&action=edit Bug 28998: (follow-up) Apply changes to TwoFactorAuth module and script Test plan: Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Walk thru cycle register - logout/login - deregister - logout/login. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133320|0 |1 is obsolete| | --- Comment #24 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133526 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133526&action=edit Bug 28998: Adjust Selenium test Test plan: Run t/db_dependent/selenium/authentication_2fa.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133321|0 |1 is obsolete| | --- Comment #25 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133527 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133527&action=edit Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test This patch can be squashed with the previous one, if all is ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133322|0 |1 is obsolete| | --- Comment #26 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133528 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133528&action=edit Bug 28998: Add encryption_key to the config file Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133323|0 |1 is obsolete| | --- Comment #27 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133529 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133529&action=edit Bug 28998: Add Crypt::CBC dependency Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #28 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Trivial rebase on Patron -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133523|0 |1 is obsolete| | --- Comment #29 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133580 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133580&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [AMENDED] Added copyright line to module. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133524|0 |1 is obsolete| | --- Comment #30 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133581 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133581&action=edit Bug 28998: (follow-up) Add Patron->encode_secret and ->decoded_secret Test plan: Run t/db_dependent/Koha/Patron.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133525|0 |1 is obsolete| | --- Comment #31 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133582 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133582&action=edit Bug 28998: (follow-up) Apply changes to TwoFactorAuth module and script Test plan: Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Walk thru cycle register - logout/login - deregister - logout/login. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133526|0 |1 is obsolete| | --- Comment #32 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133583 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133583&action=edit Bug 28998: Adjust Selenium test Test plan: Run t/db_dependent/selenium/authentication_2fa.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133527|0 |1 is obsolete| | --- Comment #33 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133584 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133584&action=edit Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test This patch can be squashed with the previous one, if all is ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133528|0 |1 is obsolete| | --- Comment #34 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133585 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133585&action=edit Bug 28998: Add encryption_key to the config file Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133529|0 |1 is obsolete| | --- Comment #35 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133586 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133586&action=edit Bug 28998: Add Crypt::CBC dependency Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #36 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- This all makes a lot of sense to me.. I can see a case in the future for a distinct table, but I'm not aware of an allow-list on reports yet so that can come later in my opinion. I wonder slightly about the accessor names in Koha::Patron.. we could just silently encrypt/descrypt and continue to rely on 'secret' as our accessor name.. but that's not a big issue. I also wonder if the field in general should be clearer.. this secret us specific to this form of on time password for 2FA.. calling is 'secret' is very generic.. but again.. that's from the earlier bug. As is it.. PQA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #37 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133588 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133588&action=edit Bug 28998: (QA follow-up) POD Fix This POD fix keeps the QA script happy Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Signed Off --- Comment #38 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Still working here.. I just found it not working on my checkout and I'm not sure why.. setting back to give me time to work backwards. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #39 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- OK, I spotted it.. I had dropped the config between first and second test. So.. I think this highlights an issue.. we should probably try/catch to give a better error than the 500 we currently throw on lack of configuration.. or fallback to unencrypted secrets when the key is missing.. but that re-introduces the security issue. Might even be worth a script to quickly encrypt un-encrypted secrets at upgrade if we don't get this pushed prior to release -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30592 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30592 [Bug 30592] Move borrowers.secret to a new generic credentials table -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |BLOCKED --- Comment #40 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Looking here -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133580|0 |1 is obsolete| | --- Comment #41 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133619 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133619&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [AMENDED] Added copyright line to module. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133581|0 |1 is obsolete| | --- Comment #42 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133620 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133620&action=edit Bug 28998: (follow-up) Add Patron->encode_secret and ->decoded_secret Test plan: Run t/db_dependent/Koha/Patron.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133582|0 |1 is obsolete| | --- Comment #43 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133621 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133621&action=edit Bug 28998: (follow-up) Apply changes to TwoFactorAuth module and script Test plan: Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Walk thru cycle register - logout/login - deregister - logout/login. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133583|0 |1 is obsolete| | --- Comment #44 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133622 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133622&action=edit Bug 28998: Adjust Selenium test Test plan: Run t/db_dependent/selenium/authentication_2fa.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133584|0 |1 is obsolete| | --- Comment #45 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133623 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133623&action=edit Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test This patch can be squashed with the previous one, if all is ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133585|0 |1 is obsolete| | --- Comment #46 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133624 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133624&action=edit Bug 28998: Add encryption_key to the config file Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133586|0 |1 is obsolete| | --- Comment #47 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133625 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133625&action=edit Bug 28998: Add Crypt::CBC dependency Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133588|0 |1 is obsolete| | --- Comment #48 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133626 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133626&action=edit Bug 28998: (QA follow-up) POD Fix This POD fix keeps the QA script happy Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #49 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133627 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133627&action=edit Bug 28998: (follow-up) Add warning on about for missing key Test plan: Make sure that you have no encryption_key in koha-conf. Check about page, system information tab. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #50 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133628 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133628&action=edit Bug 28998: Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run unit test. Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #51 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133629 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133629&action=edit Bug 28998: (follow-up) Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run unit test. Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133628|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Signed Off --- Comment #52 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Added two follow-ups to address your concerns. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_22_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #53 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Martin Renvoize from comment #36)
I wonder slightly about the accessor names in Koha::Patron.. we could just silently encrypt/descrypt and continue to rely on 'secret' as our accessor name.. but that's not a big issue. I also wonder if the field in general should be clearer.. this secret us specific to this form of on time password for 2FA.. calling is 'secret' is very generic.. but again.. that's from the earlier bug.
Actually, I did that at first and decided to go for another accessor name. This is more transparent. We could address that (if needed) when we move it out of borrowers. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133619|0 |1 is obsolete| | --- Comment #54 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133631 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133631&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [AMENDED] Added copyright line to module. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133620|0 |1 is obsolete| | --- Comment #55 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133632 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133632&action=edit Bug 28998: (follow-up) Add Patron->encode_secret and ->decoded_secret Test plan: Run t/db_dependent/Koha/Patron.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133621|0 |1 is obsolete| | --- Comment #56 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133633 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133633&action=edit Bug 28998: (follow-up) Apply changes to TwoFactorAuth module and script Test plan: Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Walk thru cycle register - logout/login - deregister - logout/login. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133622|0 |1 is obsolete| | --- Comment #57 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133634 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133634&action=edit Bug 28998: Adjust Selenium test Test plan: Run t/db_dependent/selenium/authentication_2fa.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133623|0 |1 is obsolete| | --- Comment #58 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133635 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133635&action=edit Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test This patch can be squashed with the previous one, if all is ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133624|0 |1 is obsolete| | --- Comment #59 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133636 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133636&action=edit Bug 28998: Add encryption_key to the config file Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133625|0 |1 is obsolete| | --- Comment #60 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133637 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133637&action=edit Bug 28998: Add Crypt::CBC dependency Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133626|0 |1 is obsolete| | --- Comment #61 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133638 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133638&action=edit Bug 28998: (QA follow-up) POD Fix This POD fix keeps the QA script happy Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133627|0 |1 is obsolete| | --- Comment #62 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133639 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133639&action=edit Bug 28998: (follow-up) Add warning on about for missing key Test plan: Make sure that you have no encryption_key in koha-conf. Check about page, system information tab. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133629|0 |1 is obsolete| | --- Comment #63 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133640 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133640&action=edit Bug 28998: (follow-up) Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run unit test. Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133629|0 |1 is obsolete| | --- Comment #63 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133640 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133640&action=edit Bug 28998: (follow-up) Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run unit test. Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Comment #64 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133641 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133641&action=edit Bug 28998: (follow-up) Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run t/db_dependent/Koha/Encryption.t Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133640|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133641|0 |1 is obsolete| | --- Comment #65 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 133642 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133642&action=edit Bug 28998: (follow-up) Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run t/db_dependent/Koha/Encryption.t Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30594 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 [Bug 30594] Package Crypt::CBC 2.35 or higher to increase security -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133631|0 |1 is obsolete| | --- Comment #66 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133645 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133645&action=edit Bug 28998: Introduce Koha::Encryption Test plan: Run t/db_dependent/Koha/Encryption.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [AMENDED] Added copyright line to module. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133632|0 |1 is obsolete| | --- Comment #67 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133646 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133646&action=edit Bug 28998: (follow-up) Add Patron->encode_secret and ->decoded_secret Test plan: Run t/db_dependent/Koha/Patron.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133633|0 |1 is obsolete| | --- Comment #68 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133647 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133647&action=edit Bug 28998: (follow-up) Apply changes to TwoFactorAuth module and script Test plan: Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Walk thru cycle register - logout/login - deregister - logout/login. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133634|0 |1 is obsolete| | --- Comment #69 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133648 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133648&action=edit Bug 28998: Adjust Selenium test Test plan: Run t/db_dependent/selenium/authentication_2fa.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133635|0 |1 is obsolete| | --- Comment #70 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133649 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133649&action=edit Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test This patch can be squashed with the previous one, if all is ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133636|0 |1 is obsolete| | --- Comment #71 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133650 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133650&action=edit Bug 28998: Add encryption_key to the config file Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133637|0 |1 is obsolete| | --- Comment #72 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133651 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133651&action=edit Bug 28998: Add Crypt::CBC dependency Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133638|0 |1 is obsolete| | --- Comment #73 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133652 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133652&action=edit Bug 28998: (QA follow-up) POD Fix This POD fix keeps the QA script happy Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133639|0 |1 is obsolete| | --- Comment #74 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133653 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133653&action=edit Bug 28998: (follow-up) Add warning on about for missing key Test plan: Make sure that you have no encryption_key in koha-conf. Check about page, system information tab. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #133642|0 |1 is obsolete| | --- Comment #75 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133654 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133654&action=edit Bug 28998: (follow-up) Check missing encryption key in script and module Script prints a warning. Module raises an exception. Unit test added. Test plan: Run t/db_dependent/Koha/Encryption.t Run t/db_dependent/Koha/Auth/TwoFactorAuth.t Remove entry and check script. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #76 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 133655 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=133655&action=edit Bug 28998: (QA follow-up) Improve output on error This patch updates the output_and_exit call to instead pass an error parameter in the template and use it to display the warning instead of the rest of the page content in the 'Manage two-factor authentication' page. This allows for translation and makes the page adhere to normal practices. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #77 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Right, I'm happy with this all now.. PQA.. (except it'll be blocked until the dependency bugs are all PQA too) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |BLOCKED --- Comment #78 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Selenium tests failing further down the tree so blocked until those have been fixed and PQA'd -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Failed QA --- Comment #79 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Hmm, OK.. the selenium failures are now introduced by this bug.. Is there any way to mock the config (encrpytion_key) for a selenium test? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA --- Comment #80 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- OK, so the tests do pass.. However, you need to have the encryption_key config variable set. We can't easily set this using our Mock libs, as it won't work with the selenium tests.. so I think the solution is to just ensure k-t-d has that variable always set. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30649 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #81 from Fridolin Somers <fridolin.somers@biblibre.com> --- (In reply to Martin Renvoize from comment #80)
OK, so the tests do pass.. However, you need to have the encryption_key config variable set.
We can't easily set this using our Mock libs, as it won't work with the selenium tests.. so I think the solution is to just ensure k-t-d has that variable always set.
Create a pull request on KTD ? Then I push master right ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #82 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Fridolin Somers from comment #81)
(In reply to Martin Renvoize from comment #80)
OK, so the tests do pass.. However, you need to have the encryption_key config variable set.
We can't easily set this using our Mock libs, as it won't work with the selenium tests.. so I think the solution is to just ensure k-t-d has that variable always set.
Create a pull request on KTD ? Then I push master right ?
I do not follow this. As soon as we push this patch, and packaging has been updated accordingly, a new build should be fine imo. Why do we change the order here and wait for ktd instead?? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #83 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I think Marcel is correct, once pushed k-t-d should get new packages magically and we should get the config option filled. So, go for it.. :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #84 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Personally, I would not find it an improvement if we should(!) wait for ktd updates on a local koha-conf copy while master would be fine. Btw the implicit assumption that every Koha dev uses ktd is just not true ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #85 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- ktd has its own koha-conf. If the entry is mandatory then it needs to be added there. ktd is used by Jenkins and so patches have to not break the CI. I am afraid that at least the 2FA selenium tests will fail. Note that we are talking about a one-line change patch... If we need it I can write a patch for that. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #86 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #85)
ktd has its own koha-conf. If the entry is mandatory then it needs to be added there.
ktd is used by Jenkins and so patches have to not break the CI.
I am afraid that at least the 2FA selenium tests will fail.
Note that we are talking about a one-line change patch... If we need it I can write a patch for that.
My problem is not that one line. It is the principle behind it. ktd should be smarter than this (imo). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #87 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- https://gitlab.com/koha-community/koha-testing-docker/-/merge_requests/317 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #88 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- (In reply to Marcel de Rooy from comment #86)
(In reply to Jonathan Druart from comment #85)
ktd has its own koha-conf. If the entry is mandatory then it needs to be added there.
ktd is used by Jenkins and so patches have to not break the CI.
I am afraid that at least the 2FA selenium tests will fail.
Note that we are talking about a one-line change patch... If we need it I can write a patch for that.
My problem is not that one line. It is the principle behind it. ktd should be smarter than this (imo).
Yes, it's a known problem, see https://gitlab.com/koha-community/koha-testing-docker/-/issues/281 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #89 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #88)
(In reply to Marcel de Rooy from comment #86)
(In reply to Jonathan Druart from comment #85)
ktd has its own koha-conf. If the entry is mandatory then it needs to be added there.
ktd is used by Jenkins and so patches have to not break the CI.
I am afraid that at least the 2FA selenium tests will fail.
Note that we are talking about a one-line change patch... If we need it I can write a patch for that.
My problem is not that one line. It is the principle behind it. ktd should be smarter than this (imo).
Yes, it's a known problem, see https://gitlab.com/koha-community/koha-testing-docker/-/issues/281
Ha, now we're talking :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #90 from Fridolin Somers <fridolin.somers@biblibre.com> --- Thanks a lot, I push. Sorry for not knowing much from our process. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #91 from Fridolin Somers <fridolin.somers@biblibre.com> --- I've squashed : Bug 28998: [TO_BE_SQUASHED] Adjust secret in Selenium test With Bug 28998: Adjust Selenium test -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |dependency -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #92 from Fridolin Somers <fridolin.somers@biblibre.com> --- Needs to add Crypt::CBC dependency -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #93 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Dependency is actually OK... we've already got it listed in the cpanfile on this bug and the version we're pinned to is the latest version that all our debians ship. There's another bug requesting a newer version which would allow us to tighten up security a little more.. but we don't need anything else doing here and now :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|dependency | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |22.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #94 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to master for 22.05, thanks to everybody involved 🦄 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #95 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 134636 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134636&action=edit Bug 28998: Fix Auth. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_22_05_candidate |additional_work_needed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #96 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 134637 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134637&action=edit Bug 28998: (QA follow-up) Silence some useless warnings This patch fixes the tests and also silences some useless warnings about REMOTE_ADDRESS not being defined. A test is added for a legit warning that is thrown. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #97 from Tomás Cohen Arazi <tomascohen@gmail.com> --- @RM: Follow-ups pushed to fix Jenkins. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #99 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Martin Renvoize from comment #98)
Comment on attachment 134637 [details] [review] Bug 28998: (QA follow-up) Silence some useless warnings
Review of attachment 134637 [details] [review]: -----------------------------------------------------------------
::: t/db_dependent/Auth.t @@ +151,4 @@
}
t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 0 ); + $patron->encode_secret('one_secret');
It feels weird here to require a secret set when TwoFactorAuthentication is disabled?
Thats true. I will move it a bit lower. Submitting a follow-up. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #100 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 134671 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134671&action=edit Bug 28998: (follow-up) Adjust the Auth.t fix Move the encode_secret call where we need it (when pref is enabled and patron switches to 2FA). Mock the koha-conf encryption_key. Disable 2FA when exiting subtest. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #101 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Martin: Please have a look again. @RM: Push last patch only. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master --- Comment #102 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Looking good, tests passing perfectly still. Add my SO line and pushed to master. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Bug 28998 depends on bug 29894, which changed state. Bug 29894 Summary: 2FA: Add few validations, clear secret, send register notice https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29894 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |RESOLVED Resolution|--- |FIXED CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #103 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Hi, on U22 I found this warnings: 14:36:09 koha_1 | WARNING: The key derivation method "opensslv1" is deprecated. Using -pbkdf=>'pbkdf2' would be better. 14:36:09 koha_1 | Pass -nodeprecate=>1 to inhibit this message. 14:36:09 koha_1 | at /kohadevbox/koha/Koha/Patron.pm line 2167. 14:36:09 koha_1 | WARNING: The key derivation method "opensslv1" is deprecated. Using -pbkdf=>'pbkdf2' would be better. 14:36:09 koha_1 | Pass -nodeprecate=>1 to inhibit this message. 14:36:09 koha_1 | at /kohadevbox/koha/Koha/Patron.pm line 2167. 14:36:09 koha_1 | WARNING: The key derivation method "opensslv1" is deprecated. Using -pbkdf=>'pbkdf2' would be better. 14:36:09 koha_1 | Pass -nodeprecate=>1 to inhibit this message. 14:36:09 koha_1 | at /kohadevbox/koha/Koha/Patron.pm line 2167. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #104 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- See bug 30594 ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Joy Nelson <joy@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30649 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30649 [Bug 30649] Add ability to encrypt data in Koha, use for EDI vendor accounts -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=32078 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 --- Comment #105 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #4)
How do we generate the new config entry on upgrade?
I don't think this was ever done... which has been driving me a little crazy lately 😅 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |33934 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33934 [Bug 33934] 'No encryption_key in koha-conf.xml' needs more detail -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org