https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42769
--- Comment #31 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 208467 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208467&action=edit Bug 42769: (QA follow-up) Never check a real patron password in the SIP2 message tester The tester passed the patron password it was given to the real password check and showed in the response whether it matched. That makes it a way to guess the password of any patron the user can see: there is no lockout, as the failed attempts are rolled back with everything else, and the log doesn't say what the outcome was. It also meant staff had to know, type and send the real password of a patron, which then sat in the raw request box and in the API body. The password is no longer checked at all. A request says what the outcome should be instead: - GOOD makes the password count as the patron's, anything else as wrong. The check is replaced for the time the handler runs, so the handler still builds the real "valid" and "invalid" responses. - A password that is neither GOOD nor BAD is refused with a 400, whether it comes from the form or was typed into a raw request, so the raw request box isn't a way round it. - patron_password in the API takes GOOD or BAD only. - In the staff interface the password field is a choice of "Not sent", "Valid password" and "Invalid password", and the request shows ADGOOD or ADBAD. The POD and the API description say so, and no longer need to warn that the lockout does not apply. To test: 1) prove t/db_dependent/Koha/SIP2/MessageTester.t 2) prove t/db_dependent/api/v1/sip2_account_test_message.t 3) yarn js:build, then run t/cypress/integration/SIP2/AccountTester.ts Signed-off-by: Martin Renvoize <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
