gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Martin Renvoize c1a97af67c
Bug 37893: (QA follow-up): Remove plaintext password storage from SIP2 
This follow-up removes the security vulnerability of storing plaintext
passwords in the sip_accounts table. The SIP2 system now relies entirely
on Koha's secure password authentication.

Changes:
- Remove plaintext password comparison from login_core() and telnet_transport()
- Remove login_password column from sip_accounts table
- Update database schema files and atomic update
- Remove password field from API definitions and Vue form
- Update all tests to remove login_password references

Authentication now works in two stages:
1. Access control: Check if userid exists in sip_accounts (allowlist)
2. Authentication: Validate password against hash in borrowers table

This maintains SIP access control while eliminating plaintext password
storage. Staff users authenticate with their Koha password (securely hashed).

Test plan:
1. Run updated tests to verify they pass
2. Verify SIP2 authentication works with staff user credentials
3. Confirm no plaintext passwords are stored

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2025-11-18 11:21:06 -07:00
..
AuthoritiesMarc Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Barcodes Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ClassSortRoutine Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ClassSplitRoutine Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Creators Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
External Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Form Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Heading Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ILSDI Bug 40622: Add missing interface parameter 2025-10-06 09:15:27 -06:00
Installer Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Labels Bug 40473: Use better algorithm for calculating Code39 barcode length 2025-09-26 10:36:41 -06:00
Linker Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Members Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
OAI Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Output Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Patroncards Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Reports Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
SIP Bug 37893: (QA follow-up): Remove plaintext password storage from SIP2 2025-11-18 11:21:06 -07:00
Search Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Serials Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Utils/DataTables Bug 41042: default_save_state is enabled by default 2025-10-23 11:33:32 -06:00
Accounts.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Acquisition.pm Bug 35451: (follow-up) Fix C4::Acquisition::TransferOrder 2025-11-07 10:54:06 -07:00
Auth.pm Bug 41104: Remove -sameSite from checkauth() response headers 2025-11-17 15:15:51 -07:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Auth_with_ldap.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Auth_with_shibboleth.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
AuthoritiesMarc.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Barcodes.pm Bug 18584: Remove trailing spaces in Barcodes.pm 2025-11-18 06:56:42 -07:00
Biblio.pm Bug 40983: Complete deprecation of old after_biblio_action hook signature 2025-10-14 14:51:53 -06:00
Breeding.pm Bug 40017: (follow-up) More rigorous checking 2025-10-22 07:42:53 -06:00
Budgets.pm Bug 40978: Remove warnings from Budgets.t 2025-10-24 07:57:06 -06:00
Calendar.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Charset.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Circulation.pm Bug 40866: Remove original Bug 9762 implementation remnants (Part 1) 2025-10-09 14:58:32 -06:00
ClassSortRoutine.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ClassSource.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ClassSplitRoutine.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Context.pm Bug 40943: (QA follow-up) Add a few POD lines for new sub 2025-11-03 14:13:34 -07:00
Contract.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
CourseReserves.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Creators.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
HTML5Media.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Heading.pm Bug 33296: Linker should search for authority records with an appropriate 008/14,15,16 value 2025-11-07 10:54:13 -07:00
HoldsQueue.pm Bug 40529: (QA follow-up): Add skip logic to GetPendingHoldRequestsForBib 2025-11-03 14:13:24 -07:00
ImportBatch.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ImportExportFramework.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
InstallAuth.pm Bug 40943: Use session_id from userenv instead of cookie for value_builder 2025-11-03 14:13:33 -07:00
Installer.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ItemCirculationAlertPreference.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Items.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Koha.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Letters.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Linker.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Log.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
MarcModificationTemplates.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Matcher.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Members.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Message.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Output.pm Bug 38936: Introduce C4::Output::redirect_if_opac_suppressed 2025-09-29 14:02:22 -06:00
Overdues.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Patroncards.pm Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
Record.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Reports.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Reserves.pm Bug 40529: Behavior change: Main patch 2025-11-03 14:13:22 -07:00
Ris.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
RotatingCollections.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
SMS.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Scheduler.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Scrubber.pm Bug 39860: Update scrubber profile and add Scrubber.t test 2025-11-03 14:13:47 -07:00
Search.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Serials.pm Bug 35451: (follow-up) Save join in C4::Serials::DelSubscription 2025-11-07 10:54:07 -07:00
Service.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ShelfBrowser.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
SocialData.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Stats.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Suggestions.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TTParser.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Tags.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Templates.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TmplToken.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TmplTokenType.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
UsageStats.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
XISBN.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
XSLT.pm Bug 39860: Fix selenium/opac_holds.t 2025-11-07 07:43:59 -07:00