[Bug 36679] New: anonymous patron is not blocked from checkout via self check
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Bug ID: 36679 Summary: anonymous patron is not blocked from checkout via self check Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Self checkout Assignee: koha-bugs@lists.koha-community.org Reporter: cbrannon@cdalibrary.org QA Contact: testopia@bugs.koha-community.org The anonymous patron is not allowed to checkout through the staff module, but it appears that you can login as this user on the self check and check out items. While it is more likely this could be exploited with a random library card number, this does create a hole in blocking circ on this account. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #1 from Christopher Brannon <cbrannon@cdalibrary.org> --- This also seems to be the case with SIP transactions. I've restricted the anonymous account. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #2 from Christopher Brannon <cbrannon@cdalibrary.org> --- 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! I would HIGHLY suggest preventing the account from using anonymous as the cardnumber/username. Koha should also block this patron from checking out, just like it does in the staff interface. Maybe it should just be automatically restricted account indefinitely? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Severity|enhancement |normal Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |lucas@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #3 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 165487 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=165487&action=edit Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #4 from Lucas Gass <lucas@bywatersolutions.com> --- (In reply to Christopher Brannon from comment #1)
This also seems to be the case with SIP transactions.
I've restricted the anonymous account.
Christopher, Can you file a separate bug outlining how you were able to do this via a SIP transaction? Thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #5 from Lucas Gass <lucas@bywatersolutions.com> --- This blocks the AnonymousPatron from logging in at the SCO module. Is there any reason that the AnonymousPatron should be able to log into anything? ( OPAC/SCO/Staff ) Maybe we should block this at Auth.pm? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #6 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Lucas Gass from comment #4)
(In reply to Christopher Brannon from comment #1)
This also seems to be the case with SIP transactions.
I've restricted the anonymous account.
Christopher,
Can you file a separate bug outlining how you were able to do this via a SIP transaction?
Thanks!
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36695 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36695 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #165487|0 |1 is obsolete| | --- Comment #7 from David Nind <david@davidnind.com> --- Created attachment 166025 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=166025&action=edit Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #8 from David Nind <david@davidnind.com> --- Testing notes using KTD: 1. Step 5: [hostname]/cgi-bin/koha/sco/sco-main.pl 2. Step 8: While the URL is /cgi-bin/koha/opac-main.pl, the page has the log in form in the middle and none of the normal header (including the OPAC search box). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #166025|0 |1 is obsolete| | --- Comment #9 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 167392 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167392&action=edit Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com Status|Signed Off |Passed QA --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice simple fix, passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 --- Comment #11 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes the web-based release notes| |self-checkout system to | |prevent the AnonymousPatron | |from checking out items. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37104 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 [Bug 37104] Block AnonymousPatron from logging into anything -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|anonymous patron is not |Anonymous patron is not |blocked from checkout via |blocked from checkout via |self check |self check -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.02 released in| | Status|Pushed to main |Pushed to stable --- Comment #12 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.02 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- Cool. We should consider creating Koha::Patron->is_anonymous() -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|24.11.00,24.05.02 |24.11.00,24.05.02,23.11.07 released in| | --- Comment #14 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.07 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #15 from wainuiwitikapark@catalyst.net.nz --- not backporting to 23.05.x unless requested -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|martin.renvoize@ptfs-europe | |.com | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Needs documenting --- Comment #16 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11 unless requested -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Documentation| |David Nind contact| | Status|Needs documenting |RESOLVED Documentation| |https://gitlab.com/koha-com submission| |munity/koha-manual/-/merge_ | |requests/1056 Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org