Koha-community/Koha - Koha - Koha: The world's first free and open source library system

Author	SHA1	Message	Date
Tomás Cohen Arazi	b80923d233	Bug 28772: Add a warning about hash_password usage in updatedatabase.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	3 years ago
Agustin Moyano	52deed335e	Bug 23816: (follow-up) Fix many things This patch: * reverts changes on misc/admin/set_password.pl * makes category param mandatory for AuthUtils::is_valid_password and AuthUtils::generate_password * changes onboarding.pl to set category param in AuthUtils::is_valid_password * Completes t/db_dependent/AuthUtils.t and drops t/AuthUtils.t * Removes offending <input type="number"/> and replaces it by <input type="text" inputmode="numeric" pattern="[0-9]*"/> https://bugs.koha-community.org/show_bug.cgi?id=23826 Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	4 years ago
Agustin Moyano	5848da810e	Bug 23816: Add minimum password length and require strong password overrides by category This patch adds the capability to override minPasswordLenth and RequireStrongPassword settings by category To test: 1. koha-shell kohadev 2. koha-mysql kohadev 3. drop database koha_kohadev; 4. create database koha_kohadev; 5. go to admin page and start webinstaller. There continue the steps until onboarding. 6. reach step 3 of onboarding and create a new administrator patron CHECH => Password control woks as normal (Minimum length 3 and strong required) 7. finish Koha installation and enter admin with your new administrator 8. set minPasswordLength to 3 and RequireStrongPassword to “Don’t require” 9. Create a new category (CAT2 from now on.. CAT1 is the category you made in onboarding process) and set minimum password length to 8 and require strong password 10. Create two new patrons, one with CAT1(patron1) and one with CAT2 (patron2) CHECK => In both cases, try different combinations of length and strength. For patron1 the only requirement is to have 3 letters, but for patron2 the minimum length will be 8 and will require strong password. CHECK => Try changing patron category before saving. Password requirements will change with category change. 11. Edit CAT1 and set minimum password length to 5 12. Go to patron1 details page, and change password. CHECH => Now password minimum length is 5, but still it doesn’t require strong password 13. Edit CAT1, leave blank minimum password length and set require strong password to yes. 14. Go to patron1 details page, and change password. CHECH => Password minimum length is back to 3, but now strong password is required 15. Set minimum password length in CAT2 to 12. 16. Go to patron2 details page, and click to fill a random generated password CHECK => generated password should be 12 characters length 17. Set PatronSelfRegistration to Allow in admin settings 18. Go to OPAC and fill self registration from. CHECK => Play with patron category. For each change in category, password requirements are modified. CHECK => Set CAT1 as patron category, set ‘aA1’ as password (or another valid password for CAT1) and before hitting submit button, change to CAT2. Form should enter invalid state, and CAT2 password requirements should be displayed as error in password input. 19. Create a patron for CAT1 and another for CAT2, leaving password blank CHECK => For CAT1’s patron, generated password length is 8 (minimum length for generated passwords), but for CAT2’s patron should be 12 20. In admin set PatronSelfRegistrationVerifyByEmail to require 21. Fill self registration form again with CAT2 as category CHECK => Password requirements works as previous case. 22. Leave password blank and click submit 23. select * from message_queue; 24. Copy the link in the message and paste it in OPAC CHECH => Generated password is 12 characters long. (Copy user id for next steps) 25. In admin set OpacResetPassword to Allow 26. Go back to OPAC, reload and click on “Forgot password?” link 27. Paste user id and click submit 28. Repeat steps 23 and 24 CHECK => Info message says “Your password must contain at least 12 characters, including UPPERCASE, lowercase and numbers.” CHECK => enter an invalid password and you’ll get the same message in warning. 29. Login OPAC with the last user and your newly created password 30. Go to “Change your password” option CHECK => Info message says “Your password must contain at least 12 characters, including UPPERCASE, lowercase and numbers.” CHECK => enter an invalid password and you’ll get the same message in below “New password” input. 31. prove t/db_dependent/AuthUtils.t t/db_dependent/Koha/Patron/Category.t 32. Sign off Sponsored-by: Northeast Kansas Library - NEKLS Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	4 years ago
David Roberts	81c141d41a	Bug 20370: Misleading comment for bcrypt - #encrypt it; Instead it should be #hash it This patch changes the wording of the comment To test: 1) Check the wording of Line 67 of Koha/AuthUtils.pm 2) Apply the patch 3) Check that the wording has changed from "Encrypt it" to "Hash it" Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>	4 years ago
Josef Moravec	543630b3c4	Bug 21719: Fix typos This patch was generated using codespell Test plan: Read through changes and confirm they make sense Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> https://bugs.koha-community.org/show_bug.cgi?id=21706 Signed-off-by: Nick Clemens <nick@bywatersolutions.com>	6 years ago
Jonathan Druart	3f9da34683	Bug 18298: Add server-side checks and refactor stuffs Now that we have a check client-side, nothing prevents us from a smart guy to bypass it and force an invalid password. This patch adds two new subroutines to Koha::AuthUtils to check the validity of passwords and generate a password server-side. It is used only once (self-registration) but could be useful later. Moreover the 3 different cases of password rejection (too leak, too short, contains leading or trailing whitespaces) were not tested everywhere. Now they are! This patch makes things consistent everywhere and clean up some code. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	7 years ago
Jesse Weaver	d475dae773	Bug 16818: External auth redirect broken under Plack Test plan: 0) Have either CAS or Shibboleth authentication enabled under Plack. 1) Hover over the authentication link on the staff client or OPAC, and notice that it has either '.../opac/...' or '.../intranet/...' instead of '.../cgi-bin/koha/...'. (This will be a complete dealbreaker for CAS authentication.) 2) Apply patch. 3) Check links again; they should now have the correct paths. Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Did not test CAS or Shibboleth, but no regression found. Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>	8 years ago
Jonathan Druart	017699c345	Bug 16011: $VERSION - Remove the $VERSION init Mainly a perl -p -i -e 's/^.3.07.00.049.\n//' */.pm Then some adjustements Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar> Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>	8 years ago
Jonathan Druart	fe1e6d86ca	Bug 11944: Authentication The password should be encoded before hashing. Test plan: - Before applying the patch, create a user with utf-8 in password - apply patches - try to log in - change the password - log out - try to log in Signed-off-by: Paola Rossi <paola.rossi@cineca.it> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>	10 years ago
Galen Charlton	547c6d2949	Bug 9611: (follow-up) move new password hashing routines to separate module The move avoids a problem where many modules would gain a dependency on C4::Auth just because C4::Members needs access to hash_password(). This patch also adds a couple unit tests for the new password hashing code. To test: [1] Verify that there are no regressions on the test plan for bug 9611. [2] Verify that t/AuthUtils.t and t/db_dependent/Auth.t pass. Signed-off-by: Galen Charlton <gmc@esilibrary.com>	11 years ago