This follow-up removes the security vulnerability of storing plaintext
passwords in the sip_accounts table. The SIP2 system now relies entirely
on Koha's secure password authentication.
Changes:
- Remove plaintext password comparison from login_core() and telnet_transport()
- Remove login_password column from sip_accounts table
- Update database schema files and atomic update
- Remove password field from API definitions and Vue form
- Update all tests to remove login_password references
Authentication now works in two stages:
1. Access control: Check if userid exists in sip_accounts (allowlist)
2. Authentication: Validate password against hash in borrowers table
This maintains SIP access control while eliminating plaintext password
storage. Staff users authenticate with their Koha password (securely hashed).
Test plan:
1. Run updated tests to verify they pass
2. Verify SIP2 authentication works with staff user credentials
3. Confirm no plaintext passwords are stored
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
prove t/db_dependent/Koha/SIP2/SIP2ModuleMigration.t
Test plan for the whole module:
[MODULE UI TESTING]
1) Checkout the branch and reset_all
2) Run 'updatedatabase'. The contents from
/etc/koha/sites/kohadev/SIPConfig.xml have been migrated to the
database and should be accessible in the UI.
3) Visit the administration page:
http://localhost:8081/cgi-bin/koha/admin/admin-home.pl
4) Notice the new 'Self-service circulation (SIP2)' item under 'Patrons
and circulation'. Click it.
5) Notice you are now on the new SIP2 module. Create some institutions,
accounts, listeners, etc. Play around with the forms.
6) Confirm all the data has been migrated correctly, and is editable in
the UI as expected.
[SIP TESTING]
1) On ktd, run the following SIP emulator command:
$ perl misc/sip_cli_emulator.pl -su koha -sp koha -l kohalibrary --host localhost --patron 42 -m patron_information
2) Note that the response message contains 'Greetings from Koha'.
3) Using the module UI, visit SIP accounts:
http://localhost:8081/cgi-bin/koha/sip2/accounts
4) Find the SIP account that has 'koha' as login. Click edit.
5) Scroll down to 'SIP response mappings' and click 'Add new screen msg regex'.
6) On 'Find', enter 'Greetings from Koha'. On 'Replace', enter 'Hello from 37893 test plan'. Save.
7) Repeat the sip command from 1). Note that 'Greetings from Koha has been replaced with 'Hello from 37893 test plan', without having to restart the SIP server.
[OPTIONAL]
1) You can repeat the previous steps in [MODULE UI TESTING] but edit the contents of
/etc/koha/sites/kohadev/SIPConfig.xml beforehand with a more complex and
thorough configuration (something resembling a real SIPConfig.xml)
2) After updating the contents of SIPConfig.xml, restart SIP:
koha-sip --restart
3) Test the module again, verify the contents have been migrated as
expected.
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This test file utilizes the same SIPconfig.xml as the atomicupdate.
To test different SIPConfig.xml configurations using k-t-d, edit the
contents of /etc/koha/sites/kohadev/SIPConfig.xml and run the test file
again. All tests should always pass.
[IMPORTANT]: The atomicupdate file used in this test (bug_37893.pl)
needs to be updated to the respective DBrev file when it's pushed.
prove t/db_dependent/Koha/SIP2/SIP2ModuleMigration.t
Test plan for the whole module:
1) Checkout the branch and reset_all
2) Visit the administration page:
/cgi-bin/koha/admin/admin-home.pl
3) Notice the new 'Self-service circulation (SIP2)' item under 'Patrons
and circulation'. Click it.
4) Notice you are now on the new SIP2 module. Create some institutions,
accounts, listeners, etc. Play around with the forms.
5) Notice everytime you add/edit a new SIP2 'resource', a prompt asking
to restart the SIP2 server is shown. If you confirm it, it will
restart the SIP server in order for the new data to take effect.
6) Run 'updatedatabase'. Notice the contents from
/etc/koha/sites/kohadev/SIPConfig.xml have been migrated to the
database are should be accessible in the UI.
7) Confirm all the data has been migrated correctly, and is editable in
the UI as expected.
8) You can repeat this test plan but edit the contents of
/etc/koha/sites/kohadev/SIPConfig.xml with a more complex and
thorough configuration (something resembling a real SIPConfig.xml)
9) After updating the contents of SIPConfig.xml, restart SIP:
koha-sip --restart
10) Test the module again, verify the contents have been migrated as
expected.
11) Run the migration test again to ensure that SIP2 is being served the
exact same configuration before and after the migration:
prove t/db_dependent/Koha/SIP2/SIP2ModuleMigration.t
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Pedro Amorim
Lucas Gass
Martin Renvoize
Pedro Amorim