8e2c03cc20
Koha's SIP2 server does a lot of logging, including all incoming requests, in full. This means that passwords are logged, both for the user the SIP2 client uses for logging into Koha, as well as for the end users who provide a password to e.g. check something out. This patch replaces passwords with three asterisks in log strings, before they are written to the log. To test, in ktd: - Run the new tests: $ prove t/db_dependent/SIP/Sip.t - Tail the SIP2 logs: $ sudo tail -f /var/log/koha/kohadev/sip*.log - Telnet into the SIP2 server: $ telnet localhost 6001 - Try logging in by pasting this into the telnet session: "9300CNterm1|COmypassword|CPCPL|" - Verify that "mypassword" is replaced by "***" in the logs - Try different values for the password, including the correct password which is "term1" in ktd - Try other SIP2 messages that include password fields (AC, AD, CO) Update 2024-12-03: Fix issues pointed out by QA. Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de> |
||
|---|---|---|
| .. | ||
| ILS | ||
| Sip | ||
| ILS.pm | ||
| ILS.pod | ||
| Logger.pm | ||
| Makefile | ||
| README | ||
| SIPServer.pm | ||
| Sip.pm | ||
| Trapper.pm | ||
README
README for Open NSIP 3M-SIP Server
DEPENDENCIES
SIPServer is written entirely in Perl, but it require these CPAN
perl modules to run:
Net::Server - The SIP server is a Net::Server::Prefork server
XML::LibXML
XML::Parser
XML::Simple - for parsing the config file
UNIVERSAL::require - for loading the correct ILS interface module
Clone - for running the test cases
LOGGING
SIPServer uses Koha::Logger for status and debugging messages.