Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/C4
History
Bernardo Gonzalez Kriegel cb878c35a1 Bug 12226 - A user with the database username/userid can access staff with full permissions 
This patch implements 2 suggestions on comment #3

- Prevents creation of a new user with same userid
of database user

- When checking password, if userid matches database user,
only check against pass on config file

To test:
1. Create a new user with same login as database user
any password different from real db user
2. Check that you can login on staff using this user/pass
and you are superlibrarian

3. Apply the patch

4. Login again using new pass, it must fail
5. Login again using db pass, you are now superuser,
but system does not warn you :( No problem, that's
for having one borrower with that login
6. Delete user with same login as db user
7. Try to create one again as in 1, system must return
an error of duplicate login!

8. Check for no regressions on user/pass authentication

Resubmited, has an error

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
This works nicely and as described.
Also editing the former 'superuser' will force you to
change the userid in order to save any other change.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-06-20 21:13:10 -03:00
..
AuthoritiesMarc Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Barcodes Bug 11539: removing 2 unused files 2014-01-14 20:55:28 +00:00
ClassSortRoutine Bug 9770: fix sorting of Dewey call numbers that contain prefixes 2013-07-15 16:12:47 +00:00
Creators Bug 8375: (follow-up) adjust StrWidth to account for TTF fonts 2014-05-06 18:52:12 +00:00
External Bug 12041 - improve Koha::Cache 2014-06-19 13:05:04 -03:00
Form Bug 12100: ensure that messaging preferences displays saved Days in Advance 2014-04-28 21:35:18 +00:00
Heading Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
ILSDI Bug 8918: Fix reserve priority in ILS-DI 2014-03-10 17:31:05 +00:00
Installer Bug 12259 - fix version numbers in dependencies 2014-05-16 02:48:37 +00:00
Labels Bug 8375: (follow-up) fix font code and alignment 2014-05-05 21:55:16 +00:00
Linker Bug 8447: Make sure we have enough subfields for broader_headings 2012-09-14 14:56:48 +02:00
Members Bug 12100: (follow-up) fix regression 2014-04-28 21:36:25 +00:00
OAI Bug 9295: Introduce operator equal/ notequal to OAI set mapping instead of hardcoded 'equal' value. 2013-10-10 23:03:30 +00:00
Output Fix FSF address in directory C4/ 2010-03-16 20:17:56 -04:00
Patroncards Bug 8315 - remove use C4::* version 2012-07-13 14:17:20 +02:00
Reports Bug 12214: (follow-up) correct POD of C4::Reports::Guided::execute_query() 2014-05-09 14:40:06 +00:00
Search Bug 10807: (follow-up) use 24-hour time when storing search times to session 2014-05-05 02:55:41 +00:00
Serials Bug 7688: (follow-up) update license statements 2013-10-30 02:56:32 +00:00
SIP Bug 8769: (follow-up) remove unnecessary module import 2014-05-05 15:05:28 +00:00
Utils Bug 11474: (follow-up) correct typos in POD 2014-01-06 05:46:32 +00:00
VirtualShelves Bug 8262: (follow-up) correct comment 2014-04-20 22:57:55 +00:00
Accounts.pm Bug 6273: (follow-up) fix various issues 2014-04-30 17:11:58 +00:00
Acquisition.pm Bug 11169: Display acquisition details in the OPAC 2014-06-15 11:12:24 -03:00
Auth.pm Bug 12226 - A user with the database username/userid can access staff with full permissions 2014-06-20 21:13:10 -03:00
Auth_cas_servers.yaml.orig Bug 5630 CAS improvements 2011-10-13 10:49:49 +13:00
Auth_with_cas.pm Bug 11048: Fix logout redirection for CAS authentication 2014-05-05 05:20:26 +00:00
Auth_with_ldap.pm Bug 10908: restore docs on principal_name LDAP option 2013-10-21 15:28:11 +00:00
AuthoritiesMarc.pm Bug 10330 - Rename system preference authoritysep to AuthoritySeperator 2014-05-23 13:26:48 +00:00
BackgroundJob.pm Bug 10601: (follow-up) improvements to ->set() and ->get() 2013-09-18 17:23:44 +00:00
Barcodes.pm Bug 6679 - [SIGNED-OFF] fix 8 perlcritic violations in C4/Barcodes.pm 2012-09-20 12:01:36 +02:00
Biblio.pm Bug 12343: QA follow-up 2014-06-15 11:27:20 -03:00
Bookseller.pm Bug 7965: Silence warns in staff log 2014-01-10 15:42:09 +00:00
Boolean.pm Bug 10080 - Change system pref IndependantBranches to IndependentBranches 2013-05-22 07:58:23 -07:00
Branch.pm Bug 11051: remove unneccessary SQL queries in GetBranches 2014-01-10 16:02:39 +00:00
Breeding.pm Bug 12112: remove disused routine C4::Breeding::ImportBreeding() 2014-04-25 15:07:52 +00:00
Budgets.pm Bug 12168: fix spent and ordered budget values are wrong when depth >= 2 2014-05-19 21:54:41 +00:00
Calendar.pm Bug 7351 : feature that allows to delete a range of dates 2012-09-28 12:19:45 +02:00
Category.pm Bug 7919: FIX the "all" categories method 2013-01-02 16:50:52 -05:00
Charset.pm Bug 11730: ensure that C4::Charset loads C4::Context 2014-02-18 21:52:21 +00:00
Circulation.pm Bug 11629: (follow-up) Add message for librarian that status was updated 2014-05-26 03:23:37 +00:00
ClassSortRoutine.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
ClassSource.pm Bug 10643: fix inappropriate uses of $sth->finish() in C4::ClassSource.pm 2013-08-09 15:32:22 +00:00
Context.pm Bug 9612: (follow-up) restore elementSetName in Context.pm 2014-05-19 16:46:57 +00:00
Contract.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
CourseReserves.pm bug 8215: (followup) rename GetItemReservesInfo 2013-05-21 15:51:03 -07:00
Creators.pm Bug 8315 - remove use C4::* version 2012-07-13 14:17:20 +02:00
Csv.pm Bug 10853: All existing routing to get a CSV should return a MARC csv 2013-10-11 02:16:33 +00:00
Dates.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Debug.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Heading.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
HoldsQueue.pm Bug 11258: fix another case where holds queue made transfer requests that contradict the library holds policy 2014-04-18 15:23:23 +00:00
HTML5Media.pm Bug 8377: Followup move style in a css file and do not pass template to a pm 2012-12-27 09:28:00 -05:00
Images.pm Bug 8710 - Don't show the images tab in the OPAC if the record has no local images 2012-11-28 18:54:40 -05:00
ImportBatch.pm Bug 11254: make reservoir search normalize ISBNs 2014-04-19 21:44:30 +00:00
ImportExportFramework.pm Bug 11666: remove SQL as an option for MARC framework exports and imports 2014-02-05 19:48:27 +00:00
Input.pm Bug 766: remove disused routine buildCGISort 2014-05-04 23:03:24 +00:00
InstallAuth.pm Bug 12023 - move InstallAuth.pm to be in C4 2014-05-23 13:19:42 +00:00
Installer.pm Bug 10523: Remove two obsolete routines from Installer.pm 2013-10-31 16:51:47 +00:00
ItemCirculationAlertPreference.pm Bug 6679 - [SIGNED-OFF] fix 2 perlcritic violations in C4/ItemCirculationAlertPreference.pm 2012-09-20 12:01:39 +02:00
Items.pm Bug 7720: (follow-up) revert change to GetItemsInfo 2014-05-26 02:20:24 +00:00
ItemType.pm Bug 10513: display a warning/message when returning a chosen item type 2013-09-16 17:45:31 +00:00
Koha.pm Bug 12288: (follow-up) test for defined values 2014-05-19 20:03:30 +00:00
Labels.pm Bug 8315 - remove use C4::* version 2012-07-13 14:17:20 +02:00
Languages.pm Bug 7841: quell warnings in C4::Languages 2014-05-19 16:41:50 +00:00
Letters.pm Bug 11209: (follow-up) message content must also match for new message to be considered a duplicate 2014-05-05 15:16:58 +00:00
Linker.pm Bug 7284: Fix unit test broken by erroneous POD 2012-03-08 15:24:18 +01:00
Log.pm Bug 7067 - OPAC Borrower Self Registration 2012-12-14 08:08:59 -05:00
Maintainance.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
MarcModificationTemplates.pm Bug 11479: Remove experimental given/when keywords 2014-02-20 15:55:21 +00:00
Matcher.pm Bug 10500: (follow-up) disable AggressiveMatchOnISBN if UseQueryParser is on 2014-05-05 19:31:00 +00:00
Members.pm Bug 12226 - A user with the database username/userid can access staff with full permissions 2014-06-20 21:13:10 -03:00
Message.pm Bug 6679 - [SIGNED-OFF] fix 3 perlcritic violations in C4/Message.pm 2012-09-20 12:01:39 +02:00
NewsChannels.pm Bug 7567: (follow-up) construct values clause in SQL statement more idiomatically 2014-04-07 18:14:21 +00:00
Output.pm Bug 10016: force zero browser-side caching of SCO pages 2013-10-21 18:05:12 +00:00
Overdues.pm Bug 11696: ensure that print overdue notices use the print template 2014-05-02 20:29:21 +00:00
Patroncards.pm Bug 8315 - remove use C4::* version 2012-07-13 14:17:20 +02:00
Print.pm Bug 6679 - [SIGNED-OFF] fix 2 perlcritic violations in C4/Print.pm 2012-09-20 12:17:43 +02:00
Ratings.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Record.pm Bug 11826: Use XSLT handler object in showmarc, Record.pm 2014-05-26 03:52:45 +00:00
Reports.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Reserves.pm Bug 9532: fix reservability check when bib-level item types are in use 2014-05-05 17:17:36 +00:00
Review.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Ris.pm Bug 11066: make RIS and Bibtex exports RDA compatible 2014-01-03 15:54:38 +00:00
RotatingCollections.pm Bug 11384: rename the collections_tracking.ctId column 2013-12-23 16:14:57 +00:00
Scheduler.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Scrubber.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
Search.pm Bug 10857: (follow-up) encode 'limit' parameter values 2014-05-05 21:43:33 +00:00
Serials.pm Bug 12338: Remove smartmatch operator from C4/Serials.pm 2014-06-16 15:07:01 -03:00
Service.pm POD Cleanups 2010-06-09 08:38:59 -04:00
ShelfBrowser.pm Bug 10856: (follow-up) if callnumbers are equal, order should be on itemnumber 2013-10-04 15:57:03 +00:00
SMS.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
SocialData.pm bug 7470 follow-up, fix POD doc 2012-03-26 17:53:28 +02:00
SQLHelper.pm Bug 11221: ensure that SQLHelper uses NULL rather than 0000-00-00 as default date value 2013-11-19 15:29:08 +00:00
Stats.pm Bug 4118 - Add Collection Code to Statistics Table 2012-09-13 18:42:46 +02:00
Suggestions.pm Bug 10277 - Add C4::Context->IsSuperLibrarian() 2013-12-30 15:47:23 +00:00
Tags.pm Bug 9136: C4::Tags not Plack-compatible 2012-12-22 15:47:48 -05:00
Templates.pm Bug 11848: Move language detection function in C4::Languages 2014-05-05 04:29:34 +00:00
TmplToken.pm Bug 12131: Remove unused dependency on Exporter 2014-04-25 15:24:39 +00:00
TmplTokenType.pm Revert "Bug 6679 - [SIGNED-OFF] fix 9 perlcritic violations in C4/TmplTokenType.pm" 2012-09-20 13:29:59 +02:00
TTParser.pm Bug 12207: fix TTparser's handling of TT directives that contain "]" 2014-05-23 15:23:20 +00:00
UploadedFile.pm Bug 7941 : Fix version numbers in modules 2012-06-11 17:29:38 +02:00
VirtualShelves.pm Bug 8262: explicitly warn that database admin account cannot create lists 2014-04-20 22:55:22 +00:00
XISBN.pm Bug 11096: support the retrieval of large MARCXML records 2014-02-28 19:50:09 +00:00
XSLT.pm Bug 11826: Use the XSLT handler in C4/XSLT module 2014-05-26 03:52:45 +00:00