[Bug 33253] New: 2FA - Form not excluded from autofill
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Bug ID: 33253 Summary: 2FA - Form not excluded from autofill Change sponsored?: --- Product: Koha Version: 22.05 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Staff interface Assignee: koha-bugs@lists.koha-community.org Reporter: tech.sam@salinapublic.org QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com I've been testing the 2FA module in our install, working great so far, but I noticed the authentication form field is not marked to be excluded from auto completion. Because of this, after several weeks of use, every time I click on the field, I see a list of all prior authentication codes used. This might be possible to be used in an attack to reverse-engineer the secret key using past codes and when they were entered. Even if that isn't the case, it means browsers are saving loads of unnecessary data that is one-time use. Information on how to disable auto completion in form fields can be found here: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Tur... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Sam S <tech.sam@salinapublic.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |20476 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20476 [Bug 20476] Two factor authentication for the staff client - omnibus -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |katrin.fischer@bsz-bw.de |ity.org | Version|22.05 |master -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 149725 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=149725&action=edit Bug 33253: Turn off autocompletion for 2FA authentication code The form for entering your authentication code shoudl not suggest previous codes. To test: * Activate TwoFactorAuthentication * Go to your patron account in staff * More > Manage 2-factor authentication * I used "Google authenticator" on my phone, so: * Open app on your phone, add new and scan the QR code * Enter activation code * Log out of staff interface * Log back in, you are now also asked for an authentication code as second step * Look up code in app, enter, get logged in * Log out, log back in - the form now suggests the previous code when you click on it * Apply patch * Reload things (restart_all on ktd) * Verify that you no longer get the suggestion -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 --- Comment #2 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Thx for filing Sam! Maybe you want to test? It should work on the sandboxes too: https://wiki.koha-community.org/wiki/Sandboxes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #149725|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 149733 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=149733&action=edit Bug 33253: Turn off autocompletion for 2FA authentication code The form for entering your authentication code shoudl not suggest previous codes. To test: * Activate TwoFactorAuthentication * Go to your patron account in staff * More > Manage 2-factor authentication * I used "Google authenticator" on my phone, so: * Open app on your phone, add new and scan the QR code * Enter activation code * Log out of staff interface * Log back in, you are now also asked for an authentication code as second step * Look up code in app, enter, get logged in * Log out, log back in - the form now suggests the previous code when you click on it * Apply patch * Reload things (restart_all on ktd) * Verify that you no longer get the suggestion Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #149733|0 |1 is obsolete| | --- Comment #4 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 150210 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=150210&action=edit Bug 33253: Turn off autocompletion for 2FA authentication code The form for entering your authentication code shoudl not suggest previous codes. To test: * Activate TwoFactorAuthentication * Go to your patron account in staff * More > Manage 2-factor authentication * I used "Google authenticator" on my phone, so: * Open app on your phone, add new and scan the QR code * Enter activation code * Log out of staff interface * Log back in, you are now also asked for an authentication code as second step * Look up code in app, enter, get logged in * Log out, log back in - the form now suggests the previous code when you click on it * Apply patch * Reload things (restart_all on ktd) * Verify that you no longer get the suggestion Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |23.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 23.05. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable Version(s)|23.05.00 |23.05.00,22.11.06 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 --- Comment #6 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Nice work everyone! Pushed to stable for 22.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |RESOLVED Resolution|--- |FIXED CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org