c1a97af67c
This follow-up removes the security vulnerability of storing plaintext passwords in the sip_accounts table. The SIP2 system now relies entirely on Koha's secure password authentication. Changes: - Remove plaintext password comparison from login_core() and telnet_transport() - Remove login_password column from sip_accounts table - Update database schema files and atomic update - Remove password field from API definitions and Vue form - Update all tests to remove login_password references Authentication now works in two stages: 1. Access control: Check if userid exists in sip_accounts (allowlist) 2. Authentication: Validate password against hash in borrowers table This maintains SIP access control while eliminating plaintext password storage. Staff users authenticate with their Koha password (securely hashed). Test plan: 1. Run updated tests to verify they pass 2. Verify SIP2 authentication works with staff user credentials 3. Confirm no plaintext passwords are stored Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> |
||
|---|---|---|
| .. | ||
| ILS | ||
| Sip | ||
| ILS.pm | ||
| Logger.pm | ||
| Makefile | ||
| README | ||
| SIPServer.pm | ||
| Sip.pm | ||
| Trapper.pm | ||
README
README for Open NSIP 3M-SIP Server
DEPENDENCIES
SIPServer is written entirely in Perl, but it require these CPAN
perl modules to run:
Net::Server - The SIP server is a Net::Server::Prefork server
XML::LibXML
XML::Parser
XML::Simple - for parsing the config file
UNIVERSAL::require - for loading the correct ILS interface module
Clone - for running the test cases
LOGGING
SIPServer uses Koha::Logger for status and debugging messages.