[Bug 37512] New: Add a function to reset login attempts
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Bug ID: 37512 Summary: Add a function to reset login attempts Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs@lists.koha-community.org Reporter: baptiste.wojtkowski@biblibre.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com When a user tries to much login attempts, they are blocked. There are two ways to unlock the user: 1 - Change the database 2 - Reset the password There is currently no option to simply remove the lock for a blocked account. In BZ 25947 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947) we added a button to reset the password and another to simply reset the loginattempts. This bug has been created to split the two improvements. This bugs containts the improvements related to the button to reset loginattempts -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |25947 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 [Bug 25947] Improve locked account message -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #1 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 169845 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169845&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Reset login attempts", page reloads and you see patron is unlocked -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #2 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 169846 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169846&action=edit Bug 37512: (QA follow-up) Fix filter -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |roman.dolny@jezuici.pl Status|Needs Signoff |Patch doesn't apply --- Comment #3 from Roman Dolny <roman.dolny@jezuici.pl> --- kohadev-koha@kohadevbox:koha(bug_37512)$ git bz apply 37512 Bug 37512 - Add a function to reset login attempts 169845 - Bug 37512: Add a function to reset login attempts 169846 - Bug 37512: (QA follow-up) Fix filter Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 37512: Add a function to reset login attempts error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc). error: could not build fake ancestor Patch failed at 0001 Bug 37512: Add a function to reset login attempts -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #4 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Oh I did not mention in the test plan to apply BZ25947, I add it -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169845|0 |1 is obsolete| | Attachment #169846|0 |1 is obsolete| | --- Comment #5 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 169854 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169854&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on "Reset login attempts", page reloads and you see patron is unlocked -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169854|0 |1 is obsolete| | --- Comment #6 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 169865 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169865&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on "Reset login attempts", page reloads and you see patron is unlocked Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Assignee|koha-bugs@lists.koha-commun |baptiste.wojtkowski@biblibr |ity.org |e.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com Status|Signed Off |Patch doesn't apply --- Comment #7 from Jonathan Druart <jonathan.druart@gmail.com> --- error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169865|0 |1 is obsolete| | --- Comment #8 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 176958 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176958&action=edit Bug 37512: Add a button to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #9 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Rebased on main. Note - also changed title: there is no new function -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #10 from Jonathan Druart <jonathan.druart@gmail.com> --- Double-check, there is something wrong: https://snipboard.io/S7Rt46.jpg -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #176958|0 |1 is obsolete| | --- Comment #11 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 177061 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177061&action=edit Bug 37512: Add a button to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #12 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Note: Qa tool says there is one more messy line but I could not figure out why -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #13 from Jonathan Druart <jonathan.druart@gmail.com> --- I think we should add the same icon (fa-info-circle) with the tooltip then the "reset password" link. Also we confirmation box would be nice. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #14 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179433 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179433&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179433|0 |1 is obsolete| | --- Comment #15 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179470 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179470&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing) 5. Go back to the patron's account details in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on the button to reset the login attempts. 8. There is a modal, click on confirm 9. Notice you have been redirected to the account details page. 10. Notice there is no message anymore, notice you can log in again. 11. Repeat 4-9 using the checkout page, notice you are redirected to the checkout page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #16 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179471 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179471&action=edit Bug 37512: (follow-up) Add a modal Note: this also fix the CSRF issue on this patch since 24.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Thibault Keromnès <thibault.keromnes@univ-paris8.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |thibault.keromnes@univ-pari | |s8.fr --- Comment #17 from Thibault Keromnès <thibault.keromnes@univ-paris8.fr> --- Not sure in the test plan when i should apply the patches. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #18 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- (In reply to Thibault Keromnès from comment #17)
Not sure in the test plan when i should apply the patches.
Right at the beginning. Note: I just published a rebase for the dependency patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net --- Comment #19 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Better to edit the test plan in the patch. For the clarification not be lost if another signoff roundtrip is needed and someone else attempts it. And for QA to not risk being confused by the same thing if missing the comment. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179470|0 |1 is obsolete| | --- Comment #20 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179829 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179829&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947, apply this patch 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing) 5. Go back to the patron's account details in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on the button to reset the login attempts. 8. There is a modal, click on confirm 9. Notice you have been redirected to the account details page. 10. Notice there is no message anymore, notice you can log in again. 11. Repeat 4-9 using the checkout page, notice you are redirected to the checkout page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179471|0 |1 is obsolete| | --- Comment #21 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179830 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179830&action=edit Bug 37512: (follow-up) Add a modal Note: this also fix the CSRF issue on this patch since 24.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #177061|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Stina Hallin <stina.hallin@ub.lu.se> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |stina.hallin@ub.lu.se --- Comment #22 from Stina Hallin <stina.hallin@ub.lu.se> --- Everything worked as expected, except that I didn't get the message "Patron's account has been blocked..." to show up on the accounting page. It only showed on the details and check out pages. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Stina Hallin <stina.hallin@ub.lu.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #23 from Stina Hallin <stina.hallin@ub.lu.se> --- Everything worked as expected, except that I didn't get the message "Patron's account has been blocked..." to show up on the accounting page. It only showed on the details and check out pages. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #24 from Stina Hallin <stina.hallin@ub.lu.se> --- Everything worked as expected, except that I didn't get the message "Patron's account has been blocked..." to show up on the accounting page. It only showed on the details and check out pages. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Patch doesn't apply -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179829|0 |1 is obsolete| | --- Comment #25 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 184730 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=184730&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947, apply this patch 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing) 5. Go back to the patron's account details in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on the button to reset the login attempts. 8. There is a modal, click on confirm 9. Notice you have been redirected to the account details page. 10. Notice there is no message anymore, notice you can log in again. 11. Repeat 4-9 using the checkout page, notice you are redirected to the checkout page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179830|0 |1 is obsolete| | --- Comment #26 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 184731 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=184731&action=edit Bug 37512: (follow-up) Add a modal Note: this also fix the CSRF issue on this patch since 24.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Patch doesn't apply --- Comment #27 from Jonathan Druart <jonathan.druart@gmail.com> --- CONFLICT (content): Merge conflict in koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #184730|0 |1 is obsolete| | --- Comment #28 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 188666 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188666&action=edit Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing) 5. Go back to the patron's account details in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on the button to reset the login attempts. 8. There is a modal, click on confirm 9. Notice you have been redirected to the account details page. 10. Notice there is no message anymore, notice you can log in again. 11. Repeat 4-9 using the checkout page, notice you are redirected to the checkout page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #184731|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #29 from Owen Leonard <oleonard@myacpl.org> --- In my test I ran into two problems: 1. Once I have triggered the lock, clicking the link to reset the account renews the patron as if I had clicked the "Renew" link on an expired patron account. I see the message about the account being renewed, and the expiration date is updated. The lock is also removed. 2. I tried it using both card number and username for login, and I found that I could try logging in with card number and incorrect password many times, over the FailedLoginAttempts limit, without getting a message that the account was locked. As soon as I tried the username with an incorrect password I got the lock message. As far as I can tell the failed login attempts with the card number are triggering the lock, but the login page doesn't show the error message about the lock. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #30 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Is the second point related with the patch ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #31 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 190761 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190761&action=edit Bug 37512: (follow-up) Fix the reset behaviour This follow-up fixes the notifications and behaviour of the reset login attempts function, in circ/circulation.pl and members/moremember.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 --- Comment #32 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- (In reply to Owen Leonard from comment #29)
In my test I ran into two problems:
1. Once I have triggered the lock, clicking the link to reset the account renews the patron as if I had clicked the "Renew" link on an expired patron account. I see the message about the account being renewed, and the expiration date is updated. The lock is also removed.
2. I tried it using both card number and username for login, and I found that I could try logging in with card number and incorrect password many times, over the FailedLoginAttempts limit, without getting a message that the account was locked. As soon as I tried the username with an incorrect password I got the lock message. As far as I can tell the failed login attempts with the card number are triggering the lock, but the login page doesn't show the error message about the lock.
I do not understand the second point. AFAIK, the concerned code is not part of the patch and is not supposed to provide the reason why you have been blocked. In opac-auth.tt: 75 [% IF invalid_username_or_password || too_many_login_attempts %] 76 <!-- This is what is displayed if user doesn't have permission or account is lock ed. (Do not expose more information than needed.) --> 77 <div class="alert alert-info"> 78 <p aria-live="assertive" role="alert" 79 >You entered an incorrect username or password. Please try again! But not e that passwords are case sensitive. 80 [% IF Koha.Preference('FailedLoginAttempts') %] 81 Your account will be locked after a fixed number of failed login atte mpts. 82 [% END %] 83 Please contact a library staff member if you continue to have problems.</ p 84 > 85 </div> 86 [% END %] -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Koha collecto <koha@collecto.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |koha@collecto.ca -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Jessie Zairo <jzairo@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jzairo@bywatersolutions.com Status|Needs Signoff |Failed QA --- Comment #33 from Jessie Zairo <jzairo@bywatersolutions.com> --- When testing and confirming the rest of login attempts. It is successful, however, the account the renewed - leaving a message Patron's account has been renewed until 05/26/2034 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org