PKP-OJS/OCS/OCP/OHS/OHS Fix: Add Impersonation Logging for User Record Impersonation

Vulnerability Overview A vulnerability related to user impersonation has been identified in the PKP Web Application Library (PKP-WAL). Specifically, this manifests as the logging of user impersonation events in the event logs. Affected Components This issue affects PKP applications, including OJS (Open Journal Systems), OCS (Open Conference Systems), OMP (Open Monograph Press), OPS (Open Preprint Systems), and OHS (Open Harvester Systems). Remediation 1. Add impersonation logs: Entries for user impersonation were added to the logs under the directory to facilitate tracking and recording of impersonation incidents. 2. Update columns and event descriptions: Columns and event descriptions were updated across directories including , , , , , , , , , , , and to ensure the accuracy and completeness of log records. 3. Merge remote tracking branch: In the directory, the remote tracking branch was merged to resolve translation-related issues. 4. Add spacing to improve readability: Spaces were added in the directory to enhance code readability. 5. Maintain data references and availability: Data references and data availability were preserved in the directory. 6. Default to daily, remove ocid channel and cleanup: In the directory, defaults were set to daily, and the ocid channel and cleanup procedures were removed. 7. Restore changes introduced in #10403: Changes previously introduced in issue #10403 were restored in the and directories. 8. Multiple author affiliations (Ror) - changes and fixes: Changes and fixes regarding multiple author affiliations (Ror) were implemented in the directory. 9. Introduce local uncompromised password validator: A local uncompromised password validator was introduced via . 10. Support Funder data: Support for Funder data was added in and . 11. Add hook comment fixers: Hook comment fixers were added in and . 12. Update LICENSE file to GPLv3: The file was updated to GPLv3. 13. Update issue reporting guidelines: The issue reporting guidelines in were updated. 14. Update Laravel to v9 plus dependency changes: Dependency changes associated with updating Laravel to v9 were reflected in . 15. Remove unused/dead code: Unused or dead code was removed in . 16. Upgrade Laravel for #12917: Laravel was upgraded in to address #12917. POC Code or Exploit Code No specific POC code or exploit code is included in this summary.

Goal Reached Thanks to every supporter — we hit 100%!

PKP-OJS/OCS/OCP/OHS/OHS Fix: Add Impersonation Logging for User Record Impersonation

More from this source