https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 Bug ID: 43896 Summary: Patrons can't log in with a cardnumber that matches another patron's userid Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: martin.renvoize@openfifth.co.uk CC: dpavlin@rot13.org Target Milestone: --- Since bug 40286, checkpw_internal only checks the password of the patron whose userid matches the login. If that string is also another patron's cardnumber, the cardnumber owner can no longer log in with their own password. Before 26.05 Koha fell back to the cardnumber match, so logins that worked for years break on upgrade. Each failed attempt also increments login_attempts on the userid owner. This affects everything that goes through C4::Auth::checkpw To recreate: 1) Create patron A with cardnumber TESTCARD and a password 2) Create patron B with userid TESTCARD and a different password 3) Log into the OPAC as TESTCARD with patron A's password 4) Note "You entered an incorrect username or password" 5) Note patron B's login_attempts went up -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.