This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "main Koha release repository".
The branch, 20.05.x has been updated
via 57a9bf3ef2e4f25227a10f16cec7fb34e162199e (commit)
from 4c10f83dc00ff1b94810a56cf4e7f3a5f97b3c95 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 57a9bf3ef2e4f25227a10f16cec7fb34e162199e
Author: Fridolin Somers <[email protected]>
Date: Tue Nov 3 09:19:34 2020 +0100
Bug 26904: OPAC password recovery allows regexp in email
When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this
email is one of patron's.
This check uses RegExp with case insensitive :
if ( $email && !( any { /^$email$/i } @emails ) )
This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.
I propose to use simple string compare with lowercase to be case
insensitive.
Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table
'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding
email but with different case
10) The password recovery is created (check table
'borrower_password_recovery')
Signed-off-by: Nick Clemens <[email protected]>
Signed-off-by: Julian Maurice <[email protected]>
Signed-off-by: Jonathan Druart <[email protected]>
(cherry picked from commit 904e926ba0f407b24aa3d94be5afe37b5e3ec075)
Signed-off-by: Lucas Gass <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
opac/opac-password-recovery.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
hooks/post-receive
--
main Koha release repository
_______________________________________________
koha-commits mailing list
[email protected]
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-commits
