[Bug 16711] New: OPAC Password recovery: Handling if multiple accounts have the same mail address
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Bug ID: 16711 Summary: OPAC Password recovery: Handling if multiple accounts have the same mail address Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: veron@veron.ch QA Contact: testopia@bugs.koha-community.org If multiple accounts have the same email address set as primary email and you ask for password recovery with only filling in the email address, a email is sent for one account only. Example: Create 3 Accounts, login names are test01, test02, test 03, Email is the same for all. Go to OPAC -> Password recovery and indicate E-Mail only You will get a mail for only one of the accounts above, something like: --------- This email has been sent in response to your password recovery request for the account test01 You can now create your new password using the following link: http://....... (...) --------- -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=2237 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cbrannon@cdalibrary.org --- Comment #1 from Christopher Brannon <cbrannon@cdalibrary.org> --- Perhaps require the library card number associated with the account when requesting the recovery/reset? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=11943 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #2 from David Cook <dcook@prosentient.com.au> --- I wonder how having multiple accounts with the same email address would affect the Mozilla Persona stuff. I seem to recall Chris saying that an email address should only belong to one account, although that's not enforced anywhere... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #3 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to David Cook from comment #2)
I wonder how having multiple accounts with the same email address would affect the Mozilla Persona stuff.
I seem to recall Chris saying that an email address should only belong to one account, although that's not enforced anywhere...
It's not a realistic expectation. Are parents supposed to start a new e-mail account for every child that has a library card??? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #4 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Christopher Brannon from comment #3)
(In reply to David Cook from comment #2)
I wonder how having multiple accounts with the same email address would affect the Mozilla Persona stuff.
I seem to recall Chris saying that an email address should only belong to one account, although that's not enforced anywhere...
It's not a realistic expectation. Are parents supposed to start a new e-mail account for every child that has a library card???
That being said, it may have to come down to either logging in with the card number or a combination of e-mail and card number. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- (In reply to Christopher Brannon from comment #3)
It's not a realistic expectation. Are parents supposed to start a new e-mail account for every child that has a library card???
That's certainly a valid point. I'm just pointing out that it will probably cause unexpected behaviour when using Mozilla Persona, but I don't know how many people actually use Persona anyway. As for the password reset, yeah I think it would make sense to provide userid or cardnumber as that's the unique identifier used for the patron, no? You could just put in your cardnumber/userid, and then get a message saying: "A password reset email has been send to the email address registered for account test01" Or something like that. We actually have a local password reset service... I should look how I implemented it... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 David Kuhn <techservspec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |techservspec@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #6 from David Kuhn <techservspec@gmail.com> --- I second the idea that the card number/user id should be required to reset a password, since that should always be a unique identifier. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #7 from Marc Véron <veron@veron.ch> --- Thinking loud about sending information about all library accounts if in password recovery an email with multiple library accounts attached is given: What could be the reasons to have one email address and multiple accounts? - An individual has multiple library accounts, e.g. one for professional purposes and a private one. For exammple a teacher needs books for school and wants to separate that from their private lecture. In that case sending a reset links for multiple accounts would be OK (no privacy breach) because it is the same person. But atm the mail contains only a reset link, no information that would help to identifiy the account. So the individual could reset the wrong password. - A group (family, couple) shares the same email but they have different library accounts In that case, privacy is defined by the group: Either one individual has access to the email or all of the group have access. If all have access, one individual could change the password for an other one. That would be a privacy breach. OK then, it is not a good idea to send reset links for all accounts attached to an email account. IMO the easiest solution would be not to send recovery link(s), but to display an information similar to the one that appears if an email address is not found in the database (Error No account was found with the provided information. Please...) The message could be something like: ------------- Information Multiple library accounts are attached to this email. Please fill the field 'Login' to identify which password you want to reset. Please contact the library if you need further assistance. ------------- Additionally, there could be more enhancements (to be covered by separate bugs): - Have a syspref to prevent multiple accounts with same email (could get complicated for existing installs) - Have a precooked report that displays library accounts sharing one email address -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |veron@veron.ch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #8 from Marc Véron <veron@veron.ch> --- Created attachment 63591 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=63591&action=edit Bug 16711: OPAC Password recovery: Handling if multiple accounts have the same mail address To reproduce: - Create 3 Accounts, login names are test01, test02, test03, Email is the same for all. - Go to OPAC -> Password recovery and indicate E-Mail only - You will get an email for only one of the accounts above. To test: - Apply patch, restart memcached and plack - Go to db, delete from borrower_password_recovery; - Try steps above to reproduce. You will get an error message: Account identification with this email address only is ambiguous. Please use the field 'Login' as well. - Verify that other cases work as before (provide valid / invalid login only, provide valid email for an existing account, provide unknown email, provide both login and email with all combinations of valid / invalid) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #63591|0 |1 is obsolete| | --- Comment #9 from Josef Moravec <josef.moravec@gmail.com> --- Created attachment 63600 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=63600&action=edit [SIGNED-OFF] Bug 16711: OPAC Password recovery: Handling if multiple accounts have the same mail address To reproduce: - Create 3 Accounts, login names are test01, test02, test03, Email is the same for all. - Go to OPAC -> Password recovery and indicate E-Mail only - You will get an email for only one of the accounts above. To test: - Apply patch, restart memcached and plack - Go to db, delete from borrower_password_recovery; - Try steps above to reproduce. You will get an error message: Account identification with this email address only is ambiguous. Please use the field 'Login' as well. - Verify that other cases work as before (provide valid / invalid login only, provide valid email for an existing account, provide unknown email, provide both login and email with all combinations of valid / invalid) Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=12566 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Séverine Queune <severine.queune@bulac.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |severine.queune@bulac.fr -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=18616 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #10 from David Kuhn <techservspec@gmail.com> --- Created attachment 64064 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64064&action=edit Added the code from bug 17616, which allows patron to also use their card number as a login id since there were merge conflicts with that patch. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 David Kuhn <techservspec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64064|Added the code from bug |Added the code from bug description|17616, which allows patron |18616, which allows patron |to also use their card |to also use their card |number as a login id since |number as a login id since |there were merge conflicts |there were merge conflicts |with that patch. |with that patch. Attachment #64064|Added-the-code-from-bug-176 |Added-code-from-bug-18616-w filename|16-which-allows-patron-.pat |hich-allows-patron-.patch |ch | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |18616 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18616 [Bug 18616] The "Add forgot password link to OPAC" should allow patrons to use their library card number in addition to username -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64064|0 |1 is obsolete| | --- Comment #11 from Marc Véron <veron@veron.ch> --- Comment on attachment 64064 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64064 Added the code from bug 18616, which allows patron to also use their card number as a login id since there were merge conflicts with that patch. Made 18616 dependent on 16711 and moved David's patch back to 18616, and signed off 18616 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #12 from Marc Véron <veron@veron.ch> --- Still applies on current master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com Status|Signed Off |Failed QA --- Comment #13 from Nick Clemens <nick@bywatersolutions.com> --- opac-password-recovery.pl: $search_results = [ Koha::Patrons->search( { -or => { email => $email, emailpro => $email, B_email => $email } } ) ]; $resultCount = Koha::Patrons->search( { -or => { email => $email, emailpro => $email, B_email => $email } } ) -> count; It seems we could just not get the results as an array and use count directly, casting scalar seems unnecessary as well here i.e. $search_results = Koha::Patrons->search( { -or => { email => $email, emailpro => $email, B_email => $email } } ); ... if ( not $search_results ) { ... elsif ( $username && $search_results->count > 1) ... etc. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #14 from Marc Véron <veron@veron.ch> --- Created attachment 64598 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64598&action=edit Bug 16711: (QA-followup) Use count directly See comment # 13 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #15 from Marc Véron <veron@veron.ch> --- Hope it's OK to set back to SO. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #63600|0 |1 is obsolete| | Attachment #64598|0 |1 is obsolete| | --- Comment #16 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 64604 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64604&action=edit Bug 16711: OPAC Password recovery: Handling if multiple accounts have the same mail address To reproduce: - Create 3 Accounts, login names are test01, test02, test03, Email is the same for all. - Go to OPAC -> Password recovery and indicate E-Mail only - You will get an email for only one of the accounts above. To test: - Apply patch, restart memcached and plack - Go to db, delete from borrower_password_recovery; - Try steps above to reproduce. You will get an error message: Account identification with this email address only is ambiguous. Please use the field 'Login' as well. - Verify that other cases work as before (provide valid / invalid login only, provide valid email for an existing account, provide unknown email, provide both login and email with all combinations of valid / invalid) Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #17 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 64605 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64605&action=edit Bug 16711: (QA-followup) Use count directly See comment # 13 Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #18 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Patches will be pushed squashed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #19 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Resolution|--- |FIXED Status|Pushed to Master |RESOLVED --- Comment #20 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Enhancement not pushed to 17.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #21 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I wonder if we should treat this as a bug instead, as it causes a problem for libraries with family accounts. What do you think? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #22 from Marc Véron <veron@veron.ch> --- (In reply to Katrin Fischer from comment #21)
I wonder if we should treat this as a bug instead, as it causes a problem for libraries with family accounts. What do you think?
+1 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|FIXED |--- Severity|enhancement |normal Status|RESOLVED |REOPENED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #23 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Sent back to the RMaint queue. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #24 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- (In reply to Katrin Fischer from comment #21)
I wonder if we should treat this as a bug instead, as it causes a problem for libraries with family accounts. What do you think?
Ok I'm in. Patch is small indeed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #25 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.05.x, will be in 17.05.02. If userid was mandatory, there would be no problem and this form would be more protected against attacks I's say. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=18955 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #26 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- In some libraries the patrons simply don't know their userid as it's not used by the library. Koha generates it, but the patrons don't know about it. So I don't think it should be mandatory. There is another patch I think would be very useful for 17.05 and 16.11 - bug 18616, that will also allow to use the cardnumber. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Sally Healey <sally.healey@cheshiresharedservices.gov.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sally.healey@cheshireshared | |services.gov.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #27 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Contains strings - holding this for next 16.11.x release. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #28 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- This patch has been pushed to 16.11.x and will be in 16.11.10. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 --- Comment #29 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Sorry, 16.11.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com --- Comment #30 from Mason James <mtj@kohaaloha.com> --- Pushed to 16.05.x, for 16.05.16 release -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org