Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/C4
History
Bernardo Gonzalez Kriegel cb878c35a1 Bug 12226 - A user with the database username/userid can access staff with full permissions 
This patch implements 2 suggestions on comment #3

- Prevents creation of a new user with same userid
of database user

- When checking password, if userid matches database user,
only check against pass on config file

To test:
1. Create a new user with same login as database user
any password different from real db user
2. Check that you can login on staff using this user/pass
and you are superlibrarian

3. Apply the patch

4. Login again using new pass, it must fail
5. Login again using db pass, you are now superuser,
but system does not warn you :( No problem, that's
for having one borrower with that login
6. Delete user with same login as db user
7. Try to create one again as in 1, system must return
an error of duplicate login!

8. Check for no regressions on user/pass authentication

Resubmited, has an error

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
This works nicely and as described.
Also editing the former 'superuser' will force you to
change the userid in order to save any other change.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-06-20 21:13:10 -03:00
..
AuthoritiesMarc
Barcodes Bug 11539: removing 2 unused files 2014-01-14 20:55:28 +00:00
ClassSortRoutine
Creators Bug 8375: (follow-up) adjust StrWidth to account for TTF fonts 2014-05-06 18:52:12 +00:00
External Bug 12041 - improve Koha::Cache 2014-06-19 13:05:04 -03:00
Form Bug 12100: ensure that messaging preferences displays saved Days in Advance 2014-04-28 21:35:18 +00:00
Heading
ILSDI Bug 8918: Fix reserve priority in ILS-DI 2014-03-10 17:31:05 +00:00
Installer Bug 12259 - fix version numbers in dependencies 2014-05-16 02:48:37 +00:00
Labels Bug 8375: (follow-up) fix font code and alignment 2014-05-05 21:55:16 +00:00
Linker
Members Bug 12100: (follow-up) fix regression 2014-04-28 21:36:25 +00:00
OAI
Output
Patroncards
Reports Bug 12214: (follow-up) correct POD of C4::Reports::Guided::execute_query() 2014-05-09 14:40:06 +00:00
Search Bug 10807: (follow-up) use 24-hour time when storing search times to session 2014-05-05 02:55:41 +00:00
Serials
SIP Bug 8769: (follow-up) remove unnecessary module import 2014-05-05 15:05:28 +00:00
Utils Bug 11474: (follow-up) correct typos in POD 2014-01-06 05:46:32 +00:00
VirtualShelves Bug 8262: (follow-up) correct comment 2014-04-20 22:57:55 +00:00
Accounts.pm Bug 6273: (follow-up) fix various issues 2014-04-30 17:11:58 +00:00
Acquisition.pm Bug 11169: Display acquisition details in the OPAC 2014-06-15 11:12:24 -03:00
Auth.pm Bug 12226 - A user with the database username/userid can access staff with full permissions 2014-06-20 21:13:10 -03:00
Auth_cas_servers.yaml.orig
Auth_with_cas.pm Bug 11048: Fix logout redirection for CAS authentication 2014-05-05 05:20:26 +00:00
Auth_with_ldap.pm
AuthoritiesMarc.pm Bug 10330 - Rename system preference authoritysep to AuthoritySeperator 2014-05-23 13:26:48 +00:00
BackgroundJob.pm
Barcodes.pm
Biblio.pm Bug 12343: QA follow-up 2014-06-15 11:27:20 -03:00
Bookseller.pm Bug 7965: Silence warns in staff log 2014-01-10 15:42:09 +00:00
Boolean.pm
Branch.pm Bug 11051: remove unneccessary SQL queries in GetBranches 2014-01-10 16:02:39 +00:00
Breeding.pm Bug 12112: remove disused routine C4::Breeding::ImportBreeding() 2014-04-25 15:07:52 +00:00
Budgets.pm Bug 12168: fix spent and ordered budget values are wrong when depth >= 2 2014-05-19 21:54:41 +00:00
Calendar.pm
Category.pm
Charset.pm Bug 11730: ensure that C4::Charset loads C4::Context 2014-02-18 21:52:21 +00:00
Circulation.pm Bug 11629: (follow-up) Add message for librarian that status was updated 2014-05-26 03:23:37 +00:00
ClassSortRoutine.pm
ClassSource.pm
Context.pm Bug 9612: (follow-up) restore elementSetName in Context.pm 2014-05-19 16:46:57 +00:00
Contract.pm
CourseReserves.pm
Creators.pm
Csv.pm
Dates.pm
Debug.pm
Heading.pm
HoldsQueue.pm Bug 11258: fix another case where holds queue made transfer requests that contradict the library holds policy 2014-04-18 15:23:23 +00:00
HTML5Media.pm
Images.pm
ImportBatch.pm Bug 11254: make reservoir search normalize ISBNs 2014-04-19 21:44:30 +00:00
ImportExportFramework.pm Bug 11666: remove SQL as an option for MARC framework exports and imports 2014-02-05 19:48:27 +00:00
Input.pm Bug 766: remove disused routine buildCGISort 2014-05-04 23:03:24 +00:00
InstallAuth.pm Bug 12023 - move InstallAuth.pm to be in C4 2014-05-23 13:19:42 +00:00
Installer.pm
ItemCirculationAlertPreference.pm
Items.pm Bug 7720: (follow-up) revert change to GetItemsInfo 2014-05-26 02:20:24 +00:00
ItemType.pm
Koha.pm Bug 12288: (follow-up) test for defined values 2014-05-19 20:03:30 +00:00
Labels.pm
Languages.pm Bug 7841: quell warnings in C4::Languages 2014-05-19 16:41:50 +00:00
Letters.pm Bug 11209: (follow-up) message content must also match for new message to be considered a duplicate 2014-05-05 15:16:58 +00:00
Linker.pm
Log.pm
Maintainance.pm
MarcModificationTemplates.pm Bug 11479: Remove experimental given/when keywords 2014-02-20 15:55:21 +00:00
Matcher.pm Bug 10500: (follow-up) disable AggressiveMatchOnISBN if UseQueryParser is on 2014-05-05 19:31:00 +00:00
Members.pm Bug 12226 - A user with the database username/userid can access staff with full permissions 2014-06-20 21:13:10 -03:00
Message.pm
NewsChannels.pm Bug 7567: (follow-up) construct values clause in SQL statement more idiomatically 2014-04-07 18:14:21 +00:00
Output.pm
Overdues.pm Bug 11696: ensure that print overdue notices use the print template 2014-05-02 20:29:21 +00:00
Patroncards.pm
Print.pm
Ratings.pm
Record.pm Bug 11826: Use XSLT handler object in showmarc, Record.pm 2014-05-26 03:52:45 +00:00
Reports.pm
Reserves.pm Bug 9532: fix reservability check when bib-level item types are in use 2014-05-05 17:17:36 +00:00
Review.pm
Ris.pm Bug 11066: make RIS and Bibtex exports RDA compatible 2014-01-03 15:54:38 +00:00
RotatingCollections.pm Bug 11384: rename the collections_tracking.ctId column 2013-12-23 16:14:57 +00:00
Scheduler.pm
Scrubber.pm
Search.pm Bug 10857: (follow-up) encode 'limit' parameter values 2014-05-05 21:43:33 +00:00
Serials.pm Bug 12338: Remove smartmatch operator from C4/Serials.pm 2014-06-16 15:07:01 -03:00
Service.pm
ShelfBrowser.pm
SMS.pm
SocialData.pm
SQLHelper.pm Bug 11221: ensure that SQLHelper uses NULL rather than 0000-00-00 as default date value 2013-11-19 15:29:08 +00:00
Stats.pm
Suggestions.pm Bug 10277 - Add C4::Context->IsSuperLibrarian() 2013-12-30 15:47:23 +00:00
Tags.pm
Templates.pm Bug 11848: Move language detection function in C4::Languages 2014-05-05 04:29:34 +00:00
TmplToken.pm Bug 12131: Remove unused dependency on Exporter 2014-04-25 15:24:39 +00:00
TmplTokenType.pm
TTParser.pm Bug 12207: fix TTparser's handling of TT directives that contain "]" 2014-05-23 15:23:20 +00:00
UploadedFile.pm
VirtualShelves.pm Bug 8262: explicitly warn that database admin account cannot create lists 2014-04-20 22:55:22 +00:00
XISBN.pm Bug 11096: support the retrieval of large MARCXML records 2014-02-28 19:50:09 +00:00
XSLT.pm Bug 11826: Use the XSLT handler in C4/XSLT module 2014-05-26 03:52:45 +00:00