[Bug 30088] New: Forgotten password
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Bug ID: 30088 Summary: Forgotten password Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: cbrannon@cdalibrary.org QA Contact: testopia@bugs.koha-community.org Two thoughts: Is there a reason patrons have to be presented with two fields, one for login or one for e-mail address? The prompt says to enter one or the other. Since there is the possibility for more than one account to have the same e-mail address, should we only ask for the username? The second thought is, should Koha e-mail the account user if a request has been made to reset the password? This seems to be common practice these days. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I think the idea is that the user can pick what they know/have on hand, which varies with different use cases. The email AND the login are only required if there are users with the same email address. I think often it's easier for users to give their institutional email than a cardnumber/userid. For your second question I am not sure: the user is always emailed in this process? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #2 from Christopher Brannon <cbrannon@cdalibrary.org> --- Oh, yeah! I'm having problems with ideas, apparently. Of course they already get an e-mail. As far as the two lines go, I guess perhaps it should be reworded, or maybe guided? Even though it says to enter either, it looks like you should enter both. Maybe it should start with picking one, then prompting for the info. Then if it needs more (in the case of the e-mail address being detected on more than one account) it should ask for a username. That might make it a little more clear. It just seems if you present patrons with an option to use either, and then go for the e-mail, and they actually need both, then they are going to get frustrated or give up. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Forgotten password |Improve forgotten password | |form to be more obvious | |that only one field must be | |filled out --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I like the idea of making the 'pick one' more obvious. I am rewording the description a little to make that stand out. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #4 from Christopher Brannon <cbrannon@cdalibrary.org> --- Thanks for helping me work this out, and listening. Sometimes it isn't easy to put a finger on, and I have to think a little more about what is going on. :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- My pleasure - I have no problem throwing ideas around and love learning about use cases (hence often asking a lot of questions I guess) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #6 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 134654 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134654&action=edit An idea -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #7 from Christopher Brannon <cbrannon@cdalibrary.org> --- That looks very nice! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Agreed! How do we handle the case with multiple users having the same email? (it will ask for username then) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Mirjam Vantieghem <mirjam.vantieghem@etf.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mirjam.vantieghem@etf.edu --- Comment #9 from Mirjam Vantieghem <mirjam.vantieghem@etf.edu> --- +1 We are sometimes having zealous patrons filling out both fields (when not necessary) and failing to set their password. It would be nice to have this changed to something like what Owen created. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #10 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 167642 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167642&action=edit Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out This patch updates the OPAC's forgotten password form so that the form fields are initially hidden. The user clicks on "I know my login" or "I know my email address" to display the relevant form field. To test, apply the patch and go to Administration to make sure the "OpacResetPassword" preference is enabled. - In the OPAC, click the "Forgot your password?" link on the home page. - Test the two buttons, "I know my login" and "I know my email address." Each should display the correct parts of the form. - Try submitting an email address which has been set to more than one patron. - You should get an error message, "Account identification with this email address only is ambiguous." - Both form fields should be visible. Sponsored-By: Athens County Public Libraries -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167642|0 |1 is obsolete| | --- Comment #11 from Sam Lau <samalau@gmail.com> --- Created attachment 167675 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167675&action=edit Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out This patch updates the OPAC's forgotten password form so that the form fields are initially hidden. The user clicks on "I know my login" or "I know my email address" to display the relevant form field. To test, apply the patch and go to Administration to make sure the "OpacResetPassword" preference is enabled. - In the OPAC, click the "Forgot your password?" link on the home page. - Test the two buttons, "I know my login" and "I know my email address." Each should display the correct parts of the form. - Try submitting an email address which has been set to more than one patron. - You should get an error message, "Account identification with this email address only is ambiguous." - Both form fields should be visible. Sponsored-By: Athens County Public Libraries Signed-off-by: Sam Lau <samalau@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Laura.escamilla@bywatersolu | |tions.com Status|Signed Off |Failed QA --- Comment #12 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- I love the button additions! There's just one small issue. In step 3, when you get the following error: "Account identification with this email address only is ambiguous. Please use the field 'Login' as well." It contradicts the "To reset your password, enter your login or your email address." which is still visible. We should remove this message if the new error pops up. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #13 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 170146 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170146&action=edit Bug 30088: (follow-up) Improve behavior when email is ambiguous This patch makes a few changes to the way the form appears when you submit an email which is attached to more than one patron account. Apply the patch and rebuild the OPAC CSS. - If you submit an email address which isn't unique, the "enter your login or your email address" message is hidden. - The login and email fields are marked as required. This patch also changes the behavior of the "I know my..." buttons so that they change style when clicked. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167675|0 |1 is obsolete| | --- Comment #14 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 171802 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171802&action=edit Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out This patch updates the OPAC's forgotten password form so that the form fields are initially hidden. The user clicks on "I know my login" or "I know my email address" to display the relevant form field. To test, apply the patch and go to Administration to make sure the "OpacResetPassword" preference is enabled. - In the OPAC, click the "Forgot your password?" link on the home page. - Test the two buttons, "I know my login" and "I know my email address." Each should display the correct parts of the form. - Try submitting an email address which has been set to more than one patron. - You should get an error message, "Account identification with this email address only is ambiguous." - Both form fields should be visible. Sponsored-By: Athens County Public Libraries Signed-off-by: Sam Lau <samalau@gmail.com> Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170146|0 |1 is obsolete| | --- Comment #15 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 171803 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171803&action=edit Bug 30088: (follow-up) Improve behavior when email is ambiguous This patch makes a few changes to the way the form appears when you submit an email which is attached to more than one patron account. Apply the patch and rebuild the OPAC CSS. - If you submit an email address which isn't unique, the "enter your login or your email address" message is hidden. - The login and email fields are marked as required. This patch also changes the behavior of the "I know my..." buttons so that they change style when clicked. Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #16 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- QA tool was happy and everything looks good. Passing QA here. Thanks, Owen! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |Laura.escamilla@bywatersolu |y.org |tions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I have no luck testing this :( 1) I have set up 2 accounts with the same email address and try to reset my password using the email. I get: An error occurred while sending you the password recovery link. Please try again later. Could you please run through this again and double check? 2) I feel that the text on the buttons is maybe a little bit on the big side compared to the fonts on the rest of the page. yarn build has been run. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 Klas Blomberg <klas.blomberg@skovde.se> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |klas.blomberg@skovde.se -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #18 from Klas Blomberg <klas.blomberg@skovde.se> --- I don't want to be a party-pooper, but we are contemplating to file a bug for making both email and userID mandatory The background for this: There has been a series of frauds in Sweden where the impostors have used the password recovery feature to deceive elderly people (80+ years) All swedish libraries use the equivalent to social security numbers as userID. The impostors have somehow got a list of social security numbers, and enters them one after another in password recovery. When they see that an email is sent they call the patron, saying they are calling form the library and wants to help them with their password-problem The patron gets confused and is asked to open his/her electronicID - and if they do the impostors use it to transfer money from their bank-account. One patron in a suburb to Stockholm lost 40000€ this way. Therefore we think it's too easy to recover passwords in the opac. By making both email and userID mandatory frauds like this will be next to impossible -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #19 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Klas Blomberg from comment #18)
I don't want to be a party-pooper, but we are contemplating to file a bug for making both email and userID mandatory
The background for this: There has been a series of frauds in Sweden where the impostors have used the password recovery feature to deceive elderly people (80+ years)
All swedish libraries use the equivalent to social security numbers as userID. The impostors have somehow got a list of social security numbers, and enters them one after another in password recovery. When they see that an email is sent they call the patron, saying they are calling form the library and wants to help them with their password-problem The patron gets confused and is asked to open his/her electronicID - and if they do the impostors use it to transfer money from their bank-account. One patron in a suburb to Stockholm lost 40000€ this way. Therefore we think it's too easy to recover passwords in the opac.
By making both email and userID mandatory frauds like this will be next to impossible
Hi Klas, that's a real bad story. I am sorry to hear. I think requiring userid (with it accepting either cardnumber or username) + email would be OK for us. With your argument I am not sure if it needs to be configurable. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #20 from Owen Leonard <oleonard@myacpl.org> --- I think this is also a good argument for NOT giving any indication whether a particular user id has been found. In my experience on other web sites the user would get a message like "If you have an account you will get an email." -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #21 from Christopher Brannon <cbrannon@cdalibrary.org> --- This may be something that needs to be addressed in another bug, but what about patrons that don't use email? Shouldn't there be a process for SMS as well? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30088 --- Comment #22 from Owen Leonard <oleonard@myacpl.org> --- (In reply to Christopher Brannon from comment #21)
what about patrons that don't use email? Shouldn't there be a process for SMS as well?
That would also be a separate bug. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org