[Bug 5995] New: Glitch with checkauth
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Bug #: 5995 Summary: Glitch with checkauth Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_4 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Architecture, internals, and plumbing AssignedTo: gmcharlt@gmail.com ReportedBy: chris@bigballofwax.co.nz QAContact: koha-bugs@lists.koha-community.org Blocks: 5992 -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent Patch Status|--- |Needs Signoff Severity|enhancement |major -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #1 from Chris Cormack <chris@bigballofwax.co.nz> 2011-03-29 21:19:37 UTC --- Created attachment 3508 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=3508 Proposed Patch -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED AssignedTo|gmcharlt@gmail.com |matthias.meusburger@biblibr | |e.com -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #2 from Owen Leonard <oleonard@myacpl.org> 2011-05-05 13:39:35 UTC --- The patch says "Users could log in intranet using their cardnumber, with superlibrarian rights." I don't find this to be true for just any patron. Under what circumstances is this the case? -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.poulain@biblibre.com Severity|major |blocker --- Comment #3 from Paul Poulain <paul.poulain@biblibre.com> 2011-05-09 16:00:02 UTC --- Owen: this is the case only if the library has a CAS server for authentication. ( The patch should have specified it ) also updating criticity, as it's really security issue ! -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #4 from Chris Cormack <chris@bigballofwax.co.nz> 2011-05-10 22:14:14 UTC --- Paul do you have a cas server set up we can use to test this against? -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #5 from Paul Poulain <paul.poulain@biblibre.com> 2011-05-11 08:17:28 UTC --- sorry but no :( (we used to have one locally, we have a private acces to a customer one, but nothing I can give you :(((( ) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #6 from Chris Cormack <chris@bigballofwax.co.nz> 2011-05-12 23:33:27 UTC --- I have test this locally, and it doesn't introduce any side effects. I will assume it fixes the problem with CAS and sign off, so it escalates up for QA -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #3508|0 |1 is obsolete| | --- Comment #7 from Chris Cormack <chris@bigballofwax.co.nz> 2011-05-12 23:37:51 UTC --- Created attachment 4091 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4091 Signed off patch -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ian.walls@bywatersolutions. | |com --- Comment #8 from Ian Walls <ian.walls@bywatersolutions.com> 2011-05-13 13:30:37 UTC --- To confirm, the problem is that ANY user could log in to a CAS server with their cardnumber and get superlibrarian privileges? I need to know exactly what I'm testing against in order to determine if it works or not. Also, any instructions on how to set up a local CAS server would be welcome as well. (I'm not trying to gum up the works on getting this into Koha, I just want to do the full diligence on a blocker-level bug) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wizzyrea@gmail.com --- Comment #9 from Liz Rea <wizzyrea@gmail.com> 2011-05-13 14:28:38 UTC --- I also confirm the bug and the fix. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|rel_3_4 |rel_3_6 Patch Status|Signed Off |Passed QA --- Comment #10 from Ian Walls <ian.walls@bywatersolutions.com> 2011-05-13 14:43:57 UTC --- The problem: Unless cardnumber = userid in your system, completely unprivileged patrons can log into the staff client (with superlibrarian privileges) with their cardnumber and password. This DOES NOT depend on CAS or LDAP. After applying the patch: 1. unprivileged users can no longer log into the staff client with cardnumber/password (problem resolved) 2. privileged users can still log into the staff client, either with username or cardnumber, and their correct privileges are retained 3. both privileged and unprivileged users can log into the OPAC as normal Testing regimen does not include LDAP or CAS testing, since that level of authentication is done before falling back to cardnumber authentication. Marking this patch as Passed QA. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|rel_3_6 |rel_3_4 Patch Status|Passed QA |Patch Pushed --- Comment #11 from Chris Cormack <chris@bigballofwax.co.nz> 2011-05-13 16:31:10 UTC --- Pushed to master. I think this should be cherry picked to 3.2.x as well as 3.4.x and people encouraged strongly to upgrade their versions to 3.2.8 and 3.4.1 . 3.2.8 is due out in a couple of days, perhaps we should do a security release for 3.4.1 too? -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Nighswonger <cnighswonger@foundations.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cnighswonger@foundations.ed | |u --- Comment #12 from Chris Nighswonger <cnighswonger@foundations.edu> 2011-09-07 18:14:19 UTC --- This fix has been committed to master, 3.4.x, and 3.2.x. Please test and close. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Nighswonger <cnighswonger@foundations.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|rel_3_4 |master -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Patch Pushed |Needs Signoff --- Comment #13 from Ian Walls <ian.walls@bywatersolutions.com> 2011-10-14 20:41:22 UTC --- There is a problem with checkpw's return value being misused since this patch was put in place. Cardnumber is returned, but treated as userid, particulary in the case of LDAP. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #14 from Ian Walls <ian.walls@bywatersolutions.com> 2011-10-14 20:42:06 UTC --- Created attachment 5895 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=5895 Propose Followup Patch Makes checkpw return cardnumber AND userid, in all cases, so the code can use whichever is appropriate in the context. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Patch Pushed --- Comment #15 from Chris Cormack <chris@bigballofwax.co.nz> 2011-10-15 00:26:28 UTC --- Follow up pushed, nasty bug, thanks for the catch Ian -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 --- Comment #16 from Ian Walls <ian.walls@bywatersolutions.com> 2011-10-18 14:24:19 UTC --- Created attachment 5953 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=5953 Another proposed followup patch Fixes variable scoping issue on koha/sco/sco-main.pl that was revealed with the updates to checkpw's return values. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Patch Pushed |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #5953|0 |1 is obsolete| | --- Comment #17 from Paul Poulain <paul.poulain@biblibre.com> 2011-10-21 16:55:54 UTC --- Created attachment 6022 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6022 [SIGN-OFF]Bug 5995 Follow up: variable scope in koha/sco/sco-main.pl The patronid value (cardnumber) set by checkpw in the case of SelfCheckoutByLogin was improperly scoped with 'my' inside a conditional. The changes followup to 5995 made this more apparent, causing logins to fail. Also added "parts copyright" statement to the script, since ByWater Solutions did make some significant contributions to the operations of the page Signed-off-by: Paul Poulain <paul.poulain@biblibre.com> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Passed QA --- Comment #18 from Paul Poulain <paul.poulain@biblibre.com> 2011-10-21 16:57:17 UTC --- QA comment : small patch, nothing to say from QA point of view. I've checked everything works after the patch as before. Patch submitted by ian, signed-off by me, marking "passed QA" otherwise we will be stuck ;-) Chris, please check carefully -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Passed QA |Patch Pushed --- Comment #19 from Chris Cormack <chris@bigballofwax.co.nz> 2011-10-21 17:38:26 UTC --- Pushed -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5995 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org