| commit | 2d1dad1a4afa1bfaa14715b7953ed8265dbdb398 | |
| author | Marc Véron <veron@veron.ch> | |
| Tue, 23 May 2017 05:08:41 +0000 (23 07:08 +0200) | ||
| committer | Fridolin Somers <fridolin.somers@biblibre.com> | |
| Fri, 9 Jun 2017 14:37:06 +0000 (9 16:37 +0200) | ||
| tree | 9e6dc71b9c279311a51bd0458867faf919c94fac | treesnapshot (tar.gz zip) |
| parent | 14e84e422ee5c454e2bce341a124330b047deb63 | commitdiff |
Bug 18653: Possible privacy breach with OPAC password recovery
OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like:
An email has been sent to "xxx@yyy.zz".
Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions.
To reproduce:
- Enable OPAC password recovery (syspref OpacResetPassword)
- 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester
- If such account exists, you get to know the related email address
This patch removes the email address from the success message. Additionaly, it changes
wording to address Bug 18570 ('will be sent' instead of 'has been sent')
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Simplified the wording. "Will be sent shortly" is used elsewhere too.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit eddf975cf0244c731f987c64af5126090f73f9f2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like:
An email has been sent to "xxx@yyy.zz".
Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions.
To reproduce:
- Enable OPAC password recovery (syspref OpacResetPassword)
- 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester
- If such account exists, you get to know the related email address
This patch removes the email address from the success message. Additionaly, it changes
wording to address Bug 18570 ('will be sent' instead of 'has been sent')
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Simplified the wording. "Will be sent shortly" is used elsewhere too.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit eddf975cf0244c731f987c64af5126090f73f9f2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
| koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt | diffblobblamehistory |