[Bug 10177] New: Koha Accepts Seven "Space" Characters as a Valid Password
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Bug ID: 10177 Summary: Koha Accepts Seven "Space" Characters as a Valid Password Classification: Unclassified Change sponsored?: --- Product: Koha Version: 3.10 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: gmcharlt@gmail.com Reporter: glawson@rhcl.org CC: dpavlin@rot13.org Koha 3.10.03 and presumably earlier versions accept seven "space" characters as a valid password. Concerns: 1. Some third party software using SIP to check the Koha database to authenticate users may interpret all blank characters, or even a single terminal blank character, as an invalid password. 2. gmcharlt suggests that patches submitted in the future may strip trailing whitespace characters in form input, causing pernicious perturbations. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|3.10 |master -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #1 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Verifying this is still an issue in current master -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=13441 --- Comment #2 from Marc Véron <veron@veron.ch> --- This bug is similar to Bug 13441 and should be fixed the same way as Bug 13441 (prevent new passwords with whitespace characters, but do not touch functionalliy for existing passwords that already could contain spaces characters). -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #3 from Marc Véron <veron@veron.ch> --- Maybe something for the Catalyst academy (starting today) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Academy -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #4 from Brandon <brandon_h27@hotmail.com> --- Created attachment 35265 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35265&action=edit Bug 10177 - whitespace is a valid password causing pernicious perturbations. Test plan: Go to your patron, go to change username and/or password. change password to whitespace, notice it is accepted, apply this patch, change password again, to whitespace, notice password is not valid. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Brandon <brandon_h27@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff CC| |brandon_h27@hotmail.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #5 from Marc Véron <veron@veron.ch> --- I did not test, but I compared with Bug 13441 and I think this patch should behave the same way resulting in a message like "The password entered contains whitespace characters. Please remove any whitespace characters." With other words: There should be no whitespace characters accepted at all (or at least no leading and/or trailing whitespace characters). Test in Bug 13441 is: match(/\s/) Test in this patch is: match(/^\s*$/) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #6 from Chris Cormack <chris@bigballofwax.co.nz> --- (In reply to Marc Véron from comment #5)
I did not test, but I compared with Bug 13441 and I think this patch should behave the same way resulting in a message like "The password entered contains whitespace characters. Please remove any whitespace characters."
With other words: There should be no whitespace characters accepted at all (or at least no leading and/or trailing whitespace characters).
Test in Bug 13441 is: match(/\s/)
Test in this patch is: match(/^\s*$/)
I disagree, whitespace in passwords is totally valid, a strong password is a phrase. However having a password that is entirely whitespace (which is what we are testing) is not a strong password. This patch will allow you to have whitespace in your password, but you must have other characters also. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #7 from Marc Véron <veron@veron.ch> --- Hi Chris, I agree with whitespace inside of passwords is OK. What about leading / trailing whitespace? See comment #1: --- 2. gmcharlt suggests that patches submitted in the future may strip trailing whitespace characters in form input, causing pernicious perturbations. --- -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #8 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I'de vote toward allowing whitespace within password, but not allowing it to be leading or trailing.. that allows for strong passphrases without giving ourselves headaches in the future. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #9 from Marc Véron <veron@veron.ch> --- I agree with Martin. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #10 from Brandon <brandon_h27@hotmail.com> --- Created attachment 35320 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35320&action=edit Bug 10177 - Whitespace is accepted within the password but leading and trailing spaces are not. Test plan: 1: Go to your patron 2: Go to change username and/or password. 3: Change password to something with spaces in the middle. Notice it is invalid. 4: Apply this patch. 5: Change password again using spaces in the middle. Notice it is accepted. 6: Change password with leading and/or trailing spaces, notice they are not accepted. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Brandon <brandon_h27@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35265|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #11 from Marc Véron <veron@veron.ch> --- Patch #35320 does not apply, it seems that it needs obsoleted #35265 first -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35265|1 |0 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #12 from Marc Véron <veron@veron.ch> --- Created attachment 35343 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35343&action=edit [Signede-off] Bug 10177 - whitespace is a valid password causing pernicious perturbations. Test plan: Go to your patron, go to change username and/or password. change password to whitespace, notice it is accepted, apply this patch, change password again, to whitespace, notice password is not valid. Followed test plan. Patch behaves as expected. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #13 from Marc Véron <veron@veron.ch> --- Created attachment 35344 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35344&action=edit [Signed-off] Bug 10177 - Whitespace is accepted within the password but leading and trailing spaces are not. Test plan: 1: Go to your patron 2: Go to change username and/or password. 3: Change password to something with spaces in the middle. Notice it is invalid. 4: Apply this patch. 5: Change password again using spaces in the middle. Notice it is accepted. 6: Change password with leading and/or trailing spaces, notice they are not accepted. Applied bothe patches. Followed test plan. Patch behaves as expected. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35265|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35320|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35343|0 |1 is obsolete| | Attachment #35344|0 |1 is obsolete| | --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 35356 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35356&action=edit [PASSED QA] Bug 10177 - whitespace is a valid password causing pernicious perturbations. Test plan: Go to your patron, go to change username and/or password. change password to whitespace, notice it is accepted, apply this patch, change password again, to whitespace, notice password is not valid. Followed test plan. Patch behaves as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 35357 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35357&action=edit [PASSED QA] Bug 10177 - Whitespace is accepted within the password but leading and trailing spaces are not. Test plan: 1: Go to your patron 2: Go to change username and/or password. 3: Change password to something with spaces in the middle. Notice it is invalid. 4: Apply this patch. 5: Change password again using spaces in the middle. Notice it is accepted. 6: Change password with leading and/or trailing spaces, notice they are not accepted. Applied bothe patches. Followed test plan. Patch behaves as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Brandon, thx for your patch, works great! I suggest to leave this bug open after pushing the patch as there are 2 more pages where you can chane the password: the patron edit screen and in the OPAC. I think adding the check to the OPAC too would be good. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed by Module Maintainer --- Comment #17 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushing this to the authentication module maintainers branch. https://github.com/mrenvoize/Koha/tree/authentication Cheers Brandon :) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com Status|Pushed by Module Maintainer |Pushed to Master --- Comment #18 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Patches pushed to master. Thanks Brandon! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |critical -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 --- Comment #19 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- This change is pushed to master, but only covers part of the problem - you can still set your password to whitespace in the OPAC and from the full patron edit screen without any error. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=14509 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |liz@catalyst.net.nz --- Comment #20 from Liz Rea <liz@catalyst.net.nz> --- Pushed to 3.18.x is in 3.18.12 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10177 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|Academy | -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org