CMDRShepard

You missed the one I mentioned previously, where you could log in as any existing user by entering their email address and using the password '*'. Thankfully, that appears to be resolved now. I would seriously ask that Edoocoo (or MLS, as it appears to be) consider the abilities of their security and testing staff and consider training, if such a basic (from a dev standpoint) and high-risk (from a security standpoint) flaw managed to make into live build for however many months the site has been live. The site also looks vulnerable to SQL Injection and XSS, but I'm not in the business of trying to break into people's systems anymore. I'll leave that for their security guys (I see MLS appears to have one(!) of them, which is a start...)

I honestly didn't expect that to be the case, but I had to be sure. In my line of work, it's often pragmatic to assume the worst. Might be easier to try it yourself in that case. Log out, then log in using any email address (I used yours seen as yours comes back as the default when a blank GET request is made, which is another issue I'd perhaps raise with your devs) and with just a * as the password. I think someone made a booboo when setting up your password definitions. I'd be worried if your InfoSec, Testing and Dev teams have all missed this. This should be probably the first thing they check when checking functionality as part of their unit tests, formal functional testing, and security testing, and should have been done well before the system went live with a publicly accessible domain.

Hi Charlie, good to hear from you. Personally, I would advise starting by changing your administrator password from '*' to something more secure.

I would recommend avoiding Edoocoo like the plague. I tried creating an account there last night, which failed on first attempt with no error message, so I tried again after opening the 'Inspect Element' function of Firefox so I could check if my request was actually being sent, and somehow accidentally obtained details for Charlie (who I assume to be the site's creator), including administrator password and email addresses in plain text. This website has some awful functionality and security, and if I were a customer of theirs, I'd be pushing for MLS to sack their current CyberSec/PenTest team if that's any indication of the security present in their hosted solutions. I sure as hell would not want our pupils' personal details to be publicly available on the web because they do not understand how to properly harden their public web solutions. I'm fairly sure it likely breaches some laws too.

It's interesting to see the opinion on this forum shifting with regards to MLS Support. When I first joined and read through the (at the time) previous posts on here regarding Eclipse, the majority of users were praising support, despite problems with the software. Has support really gone that far downhill? When my son was applying for tech jobs in that area (and nearly applied), I tried to do some research on the company themselves and it appears that maybe a year or two after the Capita buyout, there was a high staff turnover and it sounds like any experienced or even remotely competent may have left. Considering the pay they were offering when my son was interested (a hair over minimum wage), and (from what I read here) the general state of the system, it's possibly not surprising.

Unfortunately, I don't think that's the case. I spoke to a member of (what I think was) their support team recently, and was told that it isn't *true* HTML5, rather a HTML5 skin over what was there before. I'm not familiar with Eclipse so I don't know how this is done or whether or not it's a bad thing, but it instantly triggers alarm bells for me. How many plugins do they insist you install as part of the setup of Eclipse?

Our librarian was looking at picking up Eclipse Hosted, but we couldn't justify the price (IT are footing the library software bill, go figure). Anyone had any experience first hand with this Koha before I dive straight in?

Interestingly, my son was looking at jobs in that area and came across a helpdesk position at their Marple branch (not sure if they have others). Naturally, I got looking on glass door to see what they were like to work for...: https://www.glassdoor.co.uk/Reviews/Micro-Librarian-Systems-Reviews-E1493878.htm Sounds like a bunch of the support staff walked out, and the new staff have recently been put up to doing glowing reviews (check the dates on the positive reviews). If they're having internal conflicts, I'll be recommending to our librarian to steer clear.