https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896
--- Comment #15 from David Nind <[email protected]> --- Created attachment 210535 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=210535&action=edit Bug 43896: (QA follow-up) Hash the password once, count failures for every patron and check the right patron's password The fallback to the cardnumber owner checked the password of the first patron found before the check that logs them in, so every successful login hashed the password twice. Failed attempts were also only counted for the userid owner: once they were locked, the password of the cardnumber owner could be guessed without limit. Add Koha::Patrons->search_by_identifier, which returns the patrons an identifier can refer to as a set, in one query on the indexed userid and cardnumber columns: the userid owner first, then the cardnumber owner. The owners of a unique patron attribute are only returned when nothing else matches, as find_by_identifier always did. find_by_identifier now uses it, and so does checkpw_internal, which checks the password of each of them in turn: it is hashed once per patron the identifier refers to, and once, as before, in the usual case. checkpw now counts a failed attempt for every patron the identifier refers to, also when the first one is locked, so that guessing the password of the cardnumber owner is as limited as for anyone else. Two callers check the password of a patron they already know by passing their userid, which can also be the cardnumber of another patron, and so accepted the password of that other patron. They now check that the password found is the one of the patron they are checking: * SIP: ILS::Patron->check_password * REST: POST /api/v1/public/patrons/{patron_id}/password, whose old_password could be the password of another patron To test: 1. prove t/db_dependent/Auth.t t/db_dependent/Koha/Patrons.t \ t/db_dependent/SIP/Patron.t t/db_dependent/api/v1/patrons_password.t 2. Create patron A with userid TESTCARD and patron B with cardnumber TESTCARD, with FailedLoginAttempts set to 3 3. Log in on the OPAC as TESTCARD with each of their passwords => Both can log in 4. Enter a wrong password as TESTCARD three times => Both accounts are locked 5. As patron A, change your password on the OPAC using the password of patron B as the current password (or with the REST route) => Refused Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Martin Renvoize <[email protected]> Signed-off-by: David Nind <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
