gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
36,163 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Fridolin Somers e9b9e15106 Bug 26904: OPAC password recovery allows regexp in email 
When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Backport to 19.05.x:
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
 		2020-11-23 15:50:23 +01:00
C4 Bug 26434: add Array::Utils module [19.05] 2020-10-27 15:38:12 +01:00
Koha Bug 26639: Add auto_savepoint to DBIC connection 2020-11-17 14:16:33 +01:00
OpenILS
…
acqui Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
admin Bug 26510: Transport Cost Matrix editor doesn't show all data when HoldsQueueSkipClosed is enabled 2020-10-20 23:27:53 +02:00
api/v1 Bug 25944: Schema fix for illrequests route 2020-09-18 17:26:19 +02:00
authorities Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
basket Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
catalogue Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
cataloguing Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
circ Bug 25726: make holds to pull ignore holds where found is not null and itemnumber is null 2020-09-18 19:36:11 +02:00
clubs Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
course_reserves Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
debian Bug 26260: Add missing elastic>cnx_pool to koha-conf-site.xml.in 2020-10-29 18:01:48 +01:00
docs Update teams for 20.05 cycle 2019-11-28 18:56:59 +00:00
errors Bug 23329: Move error page to its own subroutine 2019-11-22 10:35:05 +00:00
etc Bug 26253: (bug 22857 follow-up) Remove duplicated mana_config in etc/koha-conf.xml 2020-09-18 17:43:11 +02:00
ill Bug 21460: (follow-up) Fix bugs found in QA 2019-04-25 10:46:56 +00:00
installer Bug 18050: move aqbudgetperiods table before aqbudgets, to fix sql error 2020-11-17 13:59:04 +01:00
koha-tmpl Bug 26606: Correctly URI-encode query string in URL loaded after deleting an authority record 2020-11-17 13:59:55 +01:00
labels Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
members Bug 23634: (follow-up) Prevent updates on POST 2020-08-25 05:49:41 +02:00
misc Bug 26601: Add utf8 encoding to text output of overdue_notices.pl 2020-11-17 12:55:07 +01:00
offline_circ Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
opac Bug 26904: OPAC password recovery allows regexp in email 2020-11-23 15:50:23 +01:00
patron_lists Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
patroncards Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
plugins Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
reports Bug 26090: Fix "item types" report 2020-09-20 17:40:43 +02:00
reserve Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
reviews Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
rotating_collections Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
serials Bug 26604: "Generate next" button gives error on serials-collection.pl 2020-11-17 10:28:41 +01:00
services Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
skel
…
suggestion Bug 22868: Move suggestions_manage subperm out of acquisition perm 2020-02-14 20:19:59 +00:00
svc Bug 24663: [19.05.x] Force authentication in svc/records/preview (?) 2020-08-24 18:04:47 +02:00
t Bug 26589: Fix t/db_dependent/OAI/Sets.t failing when OAI-PMH:AutoUpdateSets is enabled 2020-11-17 10:38:56 +01:00
tags Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
tmp/modified_authorities
…
tools Bug 24780: Make items.stocknumber show up in batch item modification 2020-10-29 17:58:40 +01:00
virtualshelves Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
xt Bug 21576: Keep compatibility with QA script 2018-10-26 17:09:52 +00:00
.editorconfig
…
.gitignore Bug 20427: Convert OPAC LESS to SCSS 2018-08-09 15:17:07 +00:00
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-21 12:42:19 -03:00
.scss-lint.yml Bug 21237: Clean up staff client SCSS 2018-08-24 16:23:25 +00:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Bug 18050: DBRev 19.05.16.002 2020-11-17 13:55:03 +01:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 25792: Rename 'ttf-dejavu' package to 'fonts-dejavu' for Debian 11 2020-09-20 21:16:24 +02:00
README
…
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-05-26 11:45:31 -03:00
README.robots
…
about.pl Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
gulpfile.js Bug 21751: Replace fixFloat with HC-sticky to fix Chrome display 2019-02-04 14:13:35 +00:00
help.pl Bug 19817: Use the language from the interface if valid 2018-09-06 17:32:28 +00:00
koha_perl_deps.pl Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 24663: [19.05.x] Remove authnotrequired if set to 0 2020-08-24 18:04:43 +02:00
package.json Bug 19474: Convert staff client CSS to SCSS 2018-08-09 15:12:20 +00:00
rewrite-config.PL Bug 25792: Rename 'ttf-dejavu' package to 'fonts-dejavu' for Debian 11 2020-09-20 21:16:24 +02:00
yarn.lock Bug 19474: Convert staff client CSS to SCSS 2018-08-09 15:12:20 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo