f999b1978d
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.
To test, in ktd:
- Run the new tests:
$ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
$ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
$ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
"9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)
Update 2024-12-03: Fix issues pointed out by QA.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| ILS | ||
| Sip | ||
| t | ||
| ILS.pm | ||
| ILS.pod | ||
| Logger.pm | ||
| Makefile | ||
| README | ||
| SIPServer.pm | ||
| Sip.pm | ||
| Trapper.pm | ||
README
README for Open NSIP 3M-SIP Server
DEPENDENCIES
SIPServer is written entirely in Perl, but it require these CPAN
perl modules to run:
Net::Server - The SIP server is a Net::Server::Prefork server
XML::LibXML
XML::Parser
XML::Simple - for parsing the config file
UNIVERSAL::require - for loading the correct ILS interface module
Clone - for running the test cases
LOGGING
SIPServer uses Koha::Logger for status and debugging messages.