[Bug 28660] New: Self checkout is not automatically logging in
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Bug ID: 28660 Summary: Self checkout is not automatically logging in Change sponsored?: --- Product: Koha Version: 21.05 Hardware: Other OS: Linux Status: NEW Severity: trivial Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: jhenderson@nsd.org QA Contact: testopia@bugs.koha-community.org The self-checkout is not automatically logging in with the staff username and password provided. Upon entering the URL for the self-checkout system, it is still prompting for the staff username and password. This a fresh install of Koha 21.05 on Debian 10. No errors during installation. Things I have done to ensure everything would work: - I have created a patron account with the self-check modules turned on for this patron and the username and password is listed in the system preferences under AutoSelfCheckAllowed, and that is turned to allow. - The selfcheck is enabled This is either a bug or something that I am not seeing -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jeremiah <jhenderson@nsd.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|trivial |minor -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #1 from Jeremiah <jhenderson@nsd.org> --- I have tested this same feature in multiple Koha servers that are running 21.05 and they are having the same issue. When testing this with Koha servers running 20.xx it works as described. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #2 from David Cook <dcook@prosentient.com.au> --- This sounds more like a support request than a bug. Is the "SelfCheckoutByLogin" system preference set to "Cardnumber" or "Username and Password"? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #3 from Jeremiah <jhenderson@nsd.org> --- I originally thought it was a support request too, however as I mentioned above, I tested different versions of Koha on different systems and found that any Koha system running 21.05 were unable to use the auto-login feature. Any version of Koha that was 20.xx did not have that problem. To answer the previous question, it was set to cardnumber and also username and password and neither made a difference. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- (In reply to Jeremiah from comment #3)
I originally thought it was a support request too, however as I mentioned above, I tested different versions of Koha on different systems and found that any Koha system running 21.05 were unable to use the auto-login feature. Any version of Koha that was 20.xx did not have that problem.
To answer the previous question, it was set to cardnumber and also username and password and neither made a difference.
Ah my apologies. I must not have read your original comment carefully enough. Let me take a quick look to see what I can see as this would be a huge problem... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|minor |critical --- Comment #5 from David Cook <dcook@prosentient.com.au> --- I can confirm the problem in master, so I'm raising the severity. I don't have time right now to investigate a fix, but it probably won't be too hard. I'll make a note to look again later. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|critical |blocker -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |21325 Version|21.05 |unspecified CC| |jonathan.druart+koha@gmail. | |com --- Comment #6 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- This is caused by commit da9006b20dc7439259043822902e05d392df7351 Bug 21325: Prevent authentication when sending userid and password in querystring Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21325 [Bug 21325] Prevent authentication when sending userid and password via querystring parameters -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #7 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 122617 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=122617&action=edit Bug 28660: (bug 21325 follow-up) Fix auto self check -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|oleonard@myacpl.org |dcook@prosentient.com.au --- Comment #8 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- This patch is just adding more confusion to C4::Auth and make it even more fragile. Better alternative welcomed! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #8)
This patch is just adding more confusion to C4::Auth and make it even more fragile. Better alternative welcomed!
I do have an idea, but it would require a few changes. Basically, it would be performing the autoselfcheck authentication before get_template_and_user and then passing a session object into get_template_and_user() through to checkauth(). I've done the same thing on some other patches, but have cheated each time by copying code rather than refactoring, so they're paused at the moment. We could refactor though and that would open up so many auth possibilities. But my idea will take some time and effort. Since this problem affects 21.05.x, my idea probably isn't feasible. Maybe the safest option is to just revert bug 21325. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- || ( C4::Context->preference('AutoSelfCheckID') && $q_userid eq C4::Context->preference('AutoSelfCheckID') ) Feels to me that this would need some additional checks? Like AutoSelfCheckAllowed enabled? Are we here in a self checkout context? Elsewhere I see matches for the template name? Or $query->param('koha_login_context') ne 'sco' ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #11 from David Cook <dcook@prosentient.com.au> --- (In reply to Marcel de Rooy from comment #10)
|| ( C4::Context->preference('AutoSelfCheckID') && $q_userid eq C4::Context->preference('AutoSelfCheckID') )
Feels to me that this would need some additional checks? Like AutoSelfCheckAllowed enabled?
I was thinking that too.
Are we here in a self checkout context?
Yes.
Elsewhere I see matches for the template name? Or $query->param('koha_login_context') ne 'sco' ?
Oh interesting. I do see in sco-main.pl the following within a check for AutoSelfCheckAllowed: $query->param(-name=>'koha_login_context',-values=>['sco']); That said, that's a user-provided value, so technically you could easily use it to circumvent the protection that we added... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- Ah but that koha_login_context check *plus* Jonathan's checking the userid against the AutoSelfCheckID.. that would probably be good enough although AutoSelfCheckAllowed would probably be better compared to koha_login_context, since it's a server-side call rather than provided by the client. Anyway, that's just splitting hairs. But I agree with Marcel. I think we need an extra check. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to David Cook from comment #11)
(In reply to Marcel de Rooy from comment #10)
Are we here in a self checkout context?
Yes.
Hahaha. I was aware of that. But we need to check it :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #14 from David Cook <dcook@prosentient.com.au> --- (In reply to Marcel de Rooy from comment #13)
(In reply to David Cook from comment #11)
(In reply to Marcel de Rooy from comment #10)
Are we here in a self checkout context?
Yes.
Hahaha. I was aware of that. But we need to check it :)
Haha. I'm sorry about that! I was reading that way too literally. That's what I get for trying to multi-task. I'm so embarrassed. Sorry again! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_21_05_candidate --- Comment #15 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- So, what do we do? I don't think it's a good idea to revert bug 21325 (we announced that we prevented auth by GET and now we will accept it again?). I don't see how an additional check would be helpful, but we can add it if needed (please provide a patch). Note that if AutoSelfCheckAllowed is off, the CGI param won't be set from sco-main.pl and so $q_userid won't be == AutoSelfCheckID. Additionally if we are not coming from the sco page and the user CGI param is AutoSelfCheckID we are getting kicked out earlier. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #16 from David Cook <dcook@prosentient.com.au> --- At this point, since this is affecting production instances, I think just getting any fix in is probably better than "the best fix", so let's just go ahead with this one and not delay. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|dcook@prosentient.com.au |jonathan.druart+koha@gmail. | |com Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #122617|0 |1 is obsolete| | --- Comment #17 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 122773 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=122773&action=edit Bug 28660: (bug 21325 follow-up) Fix auto self check Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Works as expected. The need for an additional check of pref WebBasedSelfCheck is merely theoretical. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | Status|Signed Off |Passed QA --- Comment #18 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- No more delays? To expedite the process, combining SO and QA. If the RM feels the need for another SO, change status.. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Signed Off --- Comment #19 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- We have a bit of time before the next 21.05 release, so yes I would like a separate QA stamp. Thanks for yours, Marcel! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Oliver Behnke <oliver.behnke@aei.mpg.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |oliver.behnke@aei.mpg.de -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|m.de.rooy@rijksmuseum.nl |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #20 from David Cook <dcook@prosentient.com.au> --- I am planning to QA this. Ran out of time yesterday. Should be able to today. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #21 from David Cook <dcook@prosentient.com.au> --- There's another potential SCO regression I'll be looking into later today as well... need to confirm that it's a problem in master first though. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #22 from David Cook <dcook@prosentient.com.au> --- Ok finally getting to this. It would've been good to have a test plan but I'll whip one up. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #23 from David Cook <dcook@prosentient.com.au> --- Test plan: 0. Don't apply patch yet 1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 2. Note that you are prompted with a regular Koha login screen 3. Apply patch 4. koha-plack --restart kohadev 5. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 6. Note that you are prompted with a Koha Self checkout system login screen 7. Log into the self checkout and note it works 8. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 9. Log into Koha and note it works -- Well that's good enough for me. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #24 from David Cook <dcook@prosentient.com.au> --- testing 1 commit(s) (applied to 3748efc 'ab Bug 28731: (bug 17600 follow-up) I') Processing files before patches |========================>| 1 / 1 (100.00%) Processing files after patches |========================>| 1 / 1 (100.00%) OK C4/Auth.pm Processing additional checks OK! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #122773|0 |1 is obsolete| | --- Comment #25 from David Cook <dcook@prosentient.com.au> --- Created attachment 123023 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=123023&action=edit Bug 28660: (bug 21325 follow-up) Fix auto self check Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Works as expected. The need for an additional check of pref WebBasedSelfCheck is merely theoretical. Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #26 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #21)
There's another potential SCO regression I'll be looking into later today as well... need to confirm that it's a problem in master first though.
The other regression I was looking for wasn't there, so must be a local problem I'm having. Thanks, Jonathan for this one. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #27 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #26)
(In reply to David Cook from comment #21)
There's another potential SCO regression I'll be looking into later today as well... need to confirm that it's a problem in master first though.
The other regression I was looking for wasn't there, so must be a local problem I'm having.
Thanks, Jonathan for this one.
Actually, it's not so much a regression as a security bug. Hurray. I love these. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |21.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 --- Comment #28 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Pushed to master for 21.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |28735 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com Status|Pushed to master |Pushed to stable Version(s)|21.11.00 |21.11.00,21.05.x released in| | --- Comment #29 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to 21.05.x for 21.05.02 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #30 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 21325 not in 20.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_21_05_candidate | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28660 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |victor@tuxayo.net Status|Pushed to stable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org