[Bug 41292] New: Add "force_password_reset_when_set_by_staff" to column name whitelist
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Bug ID: 41292 Summary: Add "force_password_reset_when_set_by_staff" to column name whitelist Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: george@nekls.org QA Contact: testopia@bugs.koha-community.org CC: lisette@bywatersolutions.com Bug 37508 added filters to Koha SQL reports and prevents them from using column names containing sensitive information. It also created a whitelist of non-sensitive columns that are accidentally blocked by that same filter. Bug 33462 added categories.force_password_reset_when_set_by_staff as a new column in the database. categories.force_password_reset_when_set_by_staff contains no sensitive data but is still blocked by the filters created in Bug 37508. categories.force_password_reset_when_set_by_staff should be added to the whitelist. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 mteal@greenvillelibrary.org changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mteal@greenvillelibrary.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |andrew@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 --- Comment #1 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Created attachment 190128 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190128&action=edit Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff To test: 1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories" 2 - observe koha prevents this save 3 - apply patch, restart services 4 - repeat step 1 5 - observe your report now saves and runs successfully While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #190128|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 190130 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190130&action=edit Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff To test: 1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories" 2 - observe koha prevents this save 3 - apply patch, restart services 4 - repeat step 1 5 - observe your report now saves and runs successfully While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Version|25.05 |Main Text to go in the| |This adds the release notes| |force_password_reset_when_s | |et_by_staff field in the | |categories table to the | |list of allowed | |password-related fields | |that can be used in SQL | |reports. | | | |Currently, this field is | |treated as containing | |sensitive password-related | |data and generates an error | |when creating a report that | |uses the field. Keywords| |Academy CC| |david@davidnind.com Severity|enhancement |normal -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Add |Add |"force_password_reset_when_ |"force_password_reset_when_ |set_by_staff" to column |set_by_staff" to the |name whitelist |allowed column name list -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This adds the |This adds the release notes|force_password_reset_when_s |force_password_reset_when_s |et_by_staff field in the |et_by_staff field in the |categories table to the |categories table to the |list of allowed |list of allowed |password-related fields |password-related fields |that can be used in SQL |that can be used in SQL |reports. |reports. | | |Currently, this field is |Currently, this field is |treated as containing |treated as containing |sensitive password-related |sensitive password-related |data and generates an error |data and generates an error |when creating a report that |when creating a report that |uses the field. |uses it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #190130|0 |1 is obsolete| | --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 190201 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190201&action=edit Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff To test: 1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories" 2 - observe koha prevents this save 3 - apply patch, restart services 4 - repeat step 1 5 - observe your report now saves and runs successfully While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37508, | |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=33462 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 --- Comment #4 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00 |26.05.00,25.11.01 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 --- Comment #5 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41292 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Depends on| |33462 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33462 [Bug 33462] Force password change for new patrons entered by staff -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org