[Bug 20632] New: Staff users without superlibrarian can't log into OPAC
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Bug ID: 20632 Summary: Staff users without superlibrarian can't log into OPAC Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org Ok, I hope it's not me, but in case it isn't, this is a bad bug: - Create or change your staff user to have all available permissions BUT superlibrarian - Log out - Log into staff - it works. Log out. - Log into OPAC - it won't work. Not good at all. This is bad for at least 2 reasons: - Often staff accounts are used like normal patron accounts by staff. - Because of permissions, sometimes the OPAC is the only place a staff user can change their password. Tested on master after a reset_all. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org Depends on| |15492 --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Caused by bug 15492 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15492 [Bug 15492] Stand alone self check-in tool -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |In Discussion --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- It's not a bug actually, but we need to do something to avoid this configuration issue: the new permissions self_check must not be set for normal users, we may need to add a warning on the permission page. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jonathan.druart@bugs.koha-c |koha-bugs@lists.koha-commun |ommunity.org |ity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Bug 20632 depends on bug 15492, which changed state. Bug 15492 Summary: Stand alone self check-in tool https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15492 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Ok, I think adding a note to Self check modules permission could help here for now. At least then, staring on permissions will give you a hint :) Maybe: Set only for self-check users, prevents OPAC login. OK? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|critical |minor --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- There is a note already: " self_checkin_module Log into the self check-in module. Note: this permission prevents the patron from using any other OPAC functionality " https://screenshots.firefox.com/578CGKmzkgVDIjEa/pro.kohadev.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WONTFIX Status|In Discussion |RESOLVED --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- You are right, I missed it because i was looking at the top level permission with the others collapsed. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Maybe we should add a warning/message on the patron's defail page? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |oleonard@myacpl.org --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Jonathan Druart from comment #6)
Maybe we should add a warning/message on the patron's defail page?
I agree. We could add something noticeable that tells the patron situation. I'm not sure where to put it. Adding Owen to the conversation. Sorry Owen! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |REOPENED Resolution|WONTFIX |--- CC| |fridolin.somers@biblibre.co | |m --- Comment #8 from Fridolin Somers <fridolin.somers@biblibre.com> --- I spend 1 hour searching for this. I reopen to add a warning message. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|REOPENED |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 --- Comment #9 from Fridolin Somers <fridolin.somers@biblibre.com> --- Created attachment 145991 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=145991&action=edit Bug 20632: Alert when SCO or SCI user in OPAC login page Special patrons for self check-out/check-in are not allowed to login into OPAC. This patch adds an alter message in OPAC login page when authentification is tried with SCO/SCI user. Test plan : 1) SCO 1.1) Use koha-testing-docker that is configured with patron 'self_checkout' 1.2) Go to OPAC main page, not logged-in 1.3) Try to login with login 'self_checkout' and password 'self_checkout' => You see an alert 'You can not loggin with self check-out user' 2) SCI 2.1) Create a new patron with login 'self_checkin', password 'self_checkin' 2.2) Define on him the permission 'self_checkin_module' 2.3) Go to OPAC main page, not logged-in 2.4) Try to login with login 'self_checkin' and password 'self_checkin' => You see an alert 'You can not loggin with self check-in user' -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |In Discussion CC| |dcook@prosentient.com.au --- Comment #10 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- I don't think this is valid, that could be considered a security issue to provide such info. C4::Auth changes without tests => FQA anyway. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20632 --- Comment #11 from Fridolin Somers <fridolin.somers@biblibre.com> --- In this case a less specific message ? Like "Login failed because of technical issue" -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org