c1a97af67c
This follow-up removes the security vulnerability of storing plaintext passwords in the sip_accounts table. The SIP2 system now relies entirely on Koha's secure password authentication. Changes: - Remove plaintext password comparison from login_core() and telnet_transport() - Remove login_password column from sip_accounts table - Update database schema files and atomic update - Remove password field from API definitions and Vue form - Update all tests to remove login_password references Authentication now works in two stages: 1. Access control: Check if userid exists in sip_accounts (allowlist) 2. Authentication: Validate password against hash in borrowers table This maintains SIP access control while eliminating plaintext password storage. Staff users authenticate with their Koha password (securely hashed). Test plan: 1. Run updated tests to verify they pass 2. Verify SIP2 authentication works with staff user credentials 3. Confirm no plaintext passwords are stored Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> |
||
|---|---|---|
| .. | ||
| v1 | ||
| swagger-v2-schema.json | ||