c1a97af67c
This follow-up removes the security vulnerability of storing plaintext passwords in the sip_accounts table. The SIP2 system now relies entirely on Koha's secure password authentication. Changes: - Remove plaintext password comparison from login_core() and telnet_transport() - Remove login_password column from sip_accounts table - Update database schema files and atomic update - Remove password field from API definitions and Vue form - Update all tests to remove login_password references Authentication now works in two stages: 1. Access control: Check if userid exists in sip_accounts (allowlist) 2. Authentication: Validate password against hash in borrowers table This maintains SIP access control while eliminating plaintext password storage. Staff users authenticate with their Koha password (securely hashed). Test plan: 1. Run updated tests to verify they pass 2. Verify SIP2 authentication works with staff user credentials 3. Confirm no plaintext passwords are stored Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> |
||
|---|---|---|
| .. | ||
| README | ||
| bug_37893.pl | ||
| skeleton.pl | ||
README
Please put your database revision files in this folder. The Release Manager will remove them from here when pushing your patches. To use the skeleton.pl for your update: % cp installer/data/mysql/atomicupdate/skeleton.pl installer/data/mysql/atomicupdate/bug_XXXXX.pl and put your modifications in where noted.