https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Alex Arnaud <alex.arnaud@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P1 - high -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 --- Comment #1 from Alex Arnaud <alex.arnaud@biblibre.com> --- Created attachment 76737 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=76737&action=edit Bug 21046: Return the correct borrowernumber when there is empty cardnumber(s) Test plan: - Use a patron with an empty cardnumber to authenticate with ILSDI AuthenticatePatron (cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=userid&password=pass), - make sure you have other patron(s) with empty cardnumber and there borrowernumber is smaller than the one you authenticate with, - you should get a wrong borrowernumber, - apply this patch, - test again, you should get the right one -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Alex Arnaud <alex.arnaud@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- We assume cardnumbers need to be unique, NULL should not be treated as a valid value. -- You are receiving this mail because: You are watching all bug changes.

I am not sure we should allow returning of a borrowernumber for an empty cardnumber. This could lead to all kinds of problems. I feel we should return an error for an empty cardnumber. It's quite common to have borrowers without cradnumber. Mostly when using third

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 --- Comment #4 from Alex Arnaud <alex.arnaud@biblibre.com> --- (In reply to Katrin Fischer from comment #2) party import tools. So this leads to have dangerous behavior on portals that use Koha as back-end. Some patron get the loans, reserves and all information about an other one.

What if 2 patrons pick the same password or are imported with the same default password?

Duplicate password doesn't matter here because we retrieve patrons with their userid (which is unique). -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com --- Comment #6 from Kyle M Hall <kyle@bywatersolutions.com> --- Won't this be a breaking change for anyone currently using ILS-DI that doesn't have cardnumber and userid set to the same thing? Would it be better to try cardnumber and fall back to userid, and simply not allow either to be an empty field? That would make it behave like the rest of Koha's login functionality, while minimizing breakages. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 --- Comment #8 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Alex Arnaud from comment #7)

(In reply to Kyle M Hall from comment #6)

...

Won't this be a breaking change for anyone currently using ILS-DI that doesn't have cardnumber and userid set to the same thing? Would it be better to try cardnumber and fall back to userid, and simply not allow either to be an empty field? That would make it behave like the rest of Koha's login functionality, while minimizing breakages.

Not sure to understand how it could be broken. For me this patch make sense even though i didn't find a bug. We pass a userid to the function, so we retrieve the patron with the userid. It is unique, and it has been authenticated by checkpw just before.

Never mind me, I am a dummy. I should have read the patch more closely. I blame mornings ;) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #76737|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Katrin Fischer from comment #9)

Kyle, you or me for sign-off now? ;)

You can qa ;) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to 18.05.x for 18.05.02 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21046 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Stable |RESOLVED Resolution|--- |FIXED --- Comment #16 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Does not apply on 17.05.x -- You are receiving this mail because: You are watching all bug changes.