gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Fridolin Somers f287fdfd81 Bug 26904: OPAC password recovery allows regexp in email 
When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 904e926ba0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 57a9bf3ef2)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
 		2020-11-24 13:06:44 +13:00
..
clubs Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
errors Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
external/overdrive bug_16034 Koha::ExternalContent::OverDrive - a wrapper around WebService::ILS::Overdrive::Patron 2017-02-21 19:58:20 +00:00
rss adding file just for creating the rss directory 2007-08-02 08:50:43 +00:00
sci Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
sco Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
svc Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
ilsdi.pl Bug 23156: Add pagination to checkouts in ILS-DI GetPatronInfo service 2019-06-25 17:16:26 +01:00
maintenance.pl Bug 17989: Include full path logic in _get_template_file 2017-11-01 13:10:17 -03:00
oai.pl Bug 14939: Modularize OAI Server existing classes 2015-12-31 15:15:05 +00:00
opac-ISBDdetail.pl Bug 23248: (QA follow-up) Consolidate 404s 2019-07-05 08:36:14 +01:00
opac-MARCdetail.pl Bug 5103: Refactor the code to avoid repetition 2020-04-03 17:26:54 +00:00
opac-account-pay-paypal-return.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-account-pay-return.pl Bug 19173: Make OPAC online payments pluggable 2017-09-19 14:15:52 -03:00
opac-account-pay.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-account.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-addbybiblionumber.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-alert-subscribe.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-article-request-cancel.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-authorities-home.pl Bug 24103: (follow-up) Dump query on opac authorities search 2020-04-01 15:29:24 +00:00
opac-authoritiesdetail.pl Bug 21871: (QA follow-up) C4::Biblio qw(GetMarcUrls) 2019-01-30 12:12:21 +00:00
opac-basket.pl Bug 23392: Don't display private notes in MARC21 2019-10-24 10:58:02 +01:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 25416: Let OPAC XSLTs know if the context is an anonymous session 2020-05-20 20:44:57 +00:00
opac-discharge.pl Bug 23723: using exit inside eval to stop sending output to browser doesn't work under plack 2019-10-07 12:21:30 +01:00
opac-downloadcart.pl Bug 17842: Simplify the code 2020-06-18 13:48:02 +12:00
opac-downloadshelf.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-export.pl Bug 22075: Fix encoding problem with RIS export in OPAC 2019-04-11 11:47:17 +00:00
opac-ics.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-idref.pl Bug 19640: fix OPAC IdRef webservice display 2017-12-07 09:37:09 -03:00
opac-illrequests.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-imageviewer.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-issue-note.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-main.pl Bug 26070: Remove GoogleIndicTransliteration system preference 2020-08-07 14:20:49 +12:00
opac-memberentry.pl Bug 25769: Patron self modification triggers change request for date of birth to null 2020-07-13 10:23:58 +12:00
opac-messaging.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-modrequest-suspend.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-modrequest.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-mymessages.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-news-rss.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-overdrive-search.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-passwd.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-password-recovery.pl Bug 26904: OPAC password recovery allows regexp in email 2020-11-24 13:06:44 +13:00
opac-patron-consent.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-patron-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-privacy.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-ratings-ajax.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-readingrecord.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-recordedbooks-search.pl Bug 17602: Fix few minor QA issues 2018-10-01 13:56:56 +00:00
opac-registration-verify.pl Bug 23253: Fix OpacNavRight for self reg by email 2019-08-15 09:19:28 +01:00
opac-renew.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-request-article.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-reserve.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-restrictedpage.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-retrieve-file.pl Bug 17501: Move getCategories and httpheaders from Upload.pm 2017-01-20 14:20:05 +00:00
opac-review.pl Bug 25340: Pass biblio object to OPAC comments template 2020-05-11 20:27:51 +00:00
opac-routing-lists.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-search-history.pl Bug 12497: Fix OPAC search history reachable by URL even when disabled 2017-12-07 10:09:52 -03:00
opac-search.pl Bug 26070: Remove GoogleIndicTransliteration system preference 2020-08-07 14:20:49 +12:00
opac-sendbasket.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-sendshelf.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-serial-issues.pl Bug 23126: Display multi-line entries in subscrpitions correctly 2019-06-25 17:18:00 +01:00
opac-shareshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-shelves.pl Bug 25982: OPAC shelves RSS link output is xml 2020-08-07 14:09:41 +12:00
opac-showmarc.pl Bug 25009: Avoid leakages in opac-showmarc.pl 2020-04-17 19:08:38 +00:00
opac-showreviews.pl Bug 22445: Custom cover images - opac reviews 2019-10-22 15:02:49 +01:00
opac-suggestions.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-tags.pl Bug 23276: Do not display tag if pref TagsEnabled is off 2020-06-22 15:04:45 +12:00
opac-tags_subject.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-topissues.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-user.pl Bug 26388: Do not show 'Renew all' or 'Renew selected' if no renewable items 2020-09-15 23:53:54 +12:00
tracklinks.pl Bug 23836: exit after output_error 2019-11-27 11:30:19 +00:00
unapi Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00