[Bug 25947] New: Improve locked account message
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Bug ID: 25947 Summary: Improve locked account message Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: caroline.cyr-la-rose@inlibro.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com Created attachment 106643 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=106643&action=edit Warning messages in the patron details When using FailedLoginAttempts, a patron's account is blocked after X many failed login attempts on the OPAC. When that happens, a message 'Account has been locked.' appears on the patron account details page. This message does not indicate why or how it was blocked. I suggest we change it to 'Account has been locked due to too many failed login attempts'. Furthermore, the font is dark red whereas the font for other warnings (such as wrong category or unpaid fines) is bright red and bold. To test: 1. Change FailedLoginAttempts to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password several times 4. Go back to the patron's account in the staff interface 5. Note that there is no indication as to why the patron's account is locked and that the font color and weight does not match the other warnings. Also, there is no button to change the password next to the warning. When a patron has unpaid fines or is in the wrong category, there is a button to either pay/writeoff the fines or change the category next to the warning. I would add a button that says 'Change password' next to the locked account warning. This might be outside the scope of this bug, but I think it would improve usability. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #1 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Again, this might be outside the scope, but I also think the OPAC message could be improved. Right now, it says 'You entered an incorrect username or password. Please try again! But note that passwords are case sensitive and that your account will be locked out after a fixed number of failed login attempts. Please contact a library staff member if you continue to have problems.' I would add the number of failed attempts rather than 'after a fixed number of failed login attempts' And I would also change the message once the account is blocked. Right now, even if FailedLoginAttempts is at 2, you can try to log in 10 times and it will never tell you that your account is now blocked. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #2 from David Cook <dcook@prosentient.com.au> --- I don't 100% understand these comments. I think that I agree that the Staff Client could be more descriptive about why the account is locked. As for the OPAC, we shouldn't indicate that the account has been locked, as that indicates to an attacker that the account exists, which is not a good idea from a security perspective. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=26823 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Assignee|koha-bugs@lists.koha-commun |fridolin.somers@biblibre.co |ity.org |m Status|NEW |ASSIGNED --- Comment #3 from Fridolin Somers <fridolin.somers@biblibre.com> --- We have the same demand. I'm on it -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22854 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |23979 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23979 [Bug 23979] "Account is locked" message should be displayed on all patron pages -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #4 from Fridolin Somers <fridolin.somers@biblibre.com> --- Created attachment 145502 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=145502&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password * a link to reset login attempts to 0 Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page 7. Click on "Reset login attempts", page reloads and you see patron in unlocked -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #5 from Fridolin Somers <fridolin.somers@biblibre.com> --- Created attachment 145503 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=145503&action=edit Screenshot of feature -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- You may ask to improve the text. We may add some text explaining the value of syspref FailedLoginAttempts, but maybe message would be too long. Reset login attempts as been asked by the library, this is a new feature. I hope it makes sens, otherwise I may create a new bug report. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Amaury GAU <amaury.gau@bulac.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |amaury.gau@bulac.fr -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #145502|0 |1 is obsolete| | --- Comment #7 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 145589 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=145589&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password * a link to reset login attempts to 0 Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page 7. Click on "Reset login attempts", page reloads and you see patron in unlocked Signed-off-by: Amaury GAU <amaury.gau@bulac.fr> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 solene.ngamga@inlibro.com changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #145589|0 |1 is obsolete| | --- Comment #8 from solene.ngamga@inlibro.com --- Created attachment 145878 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=145878&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password * a link to reset login attempts to 0 Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page 7. Click on "Reset login attempts", page reloads and you see patron in unlocked Signed-off-by: Amaury GAU <amaury.gau@bulac.fr> Signed-off-by: Solene Ngamga <solene.ngamga@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #9 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- FAIL koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc FAIL filters wrong_html_filter at line 57 ( <a href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]">Change password</a>) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |BLOCKED --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Looking here -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #11 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Fridolin Somers from comment #6)
Reset login attempts as been asked by the library, this is a new feature. I hope it makes sens, otherwise I may create a new bug report.
+my $resetloginattempts = $input->param('resetloginattempts') || ''; my $dbh = C4::Context->dbh; my $dateexpiry; @@ -54,6 +55,8 @@ if ( $logged_in_user->can_see_patron_infos($patron) ) { if ( $reregistration eq 'y' ) { # re-reregistration function to automatic calcul of date expiry $dateexpiry = $patron->renew_account; + } elsif ( $resetloginattempts eq 'y' ) { + $patron->login_attempts(0)->store; This is not expected here. Improve a message? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #12 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 147683 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=147683&action=edit Bug 25947: (QA follow-up) Fix filter -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- + or <a href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber | uri %]&destination=circ&resetloginattempts=y">Reset login attempts</a> You are doing this in an include file. Feels wrong. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #14 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- The setstatus.pl script certainly needs attention too: Reading comments like: #script to set or lift debarred status No longer true? # Ideally we should display a warning on the interface if the logged in user is # not allowed to modify this patron. # But a librarian is not supposed to hack the system No longer true? The code contains: my ( $loggedinuserid ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet'); ... $logged_in_user->can_see_patron_infos Includes: permission => 'borrowers', subpermission => 'view_borrower_infos_from_any_libraries', => Feels like it is enough. But personally I would rather see a specific permission for things like password, and locked status? Instead of using this script with a GET operation, it feels better to use our REST API and do a PUT/PATCH patron operation? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Failed QA --- Comment #15 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Conclusion: I think that you'd better split this into two reports. The reset operation needs more attention too. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #16 from David Cook <dcook@prosentient.com.au> --- (In reply to solene.ngamga from comment #8)
3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
We really shouldn't be doing this. It's best practice not to tell an unauthenticated user that an account has been locked due to failed login attempts. It leaks information about system settings and user accounts. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #17 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #16)
We really shouldn't be doing this. It's best practice not to tell an unauthenticated user that an account has been locked due to failed login attempts. It leaks information about system settings and user accounts.
If we're going to do something insecure, we should wrap it in a system preference, default it to disabled, and have explanatory text on the system preference page saying it's an insecure setting. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #18 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to David Cook from comment #17)
(In reply to David Cook from comment #16)
We really shouldn't be doing this. It's best practice not to tell an unauthenticated user that an account has been locked due to failed login attempts. It leaks information about system settings and user accounts.
If we're going to do something insecure, we should wrap it in a system preference, default it to disabled, and have explanatory text on the system preference page saying it's an insecure setting.
I thin this is a misunderstanding. The patch is not about the message that the user sees, but about the message that staff will see. +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc The user receives a neutral message still. This is to help staff to see the reason why someone has been locked out. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #19 from David Cook <dcook@prosentient.com.au> --- (In reply to Katrin Fischer from comment #18)
I thin this is a misunderstanding. The patch is not about the message that the user sees, but about the message that staff will see.
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
The user receives a neutral message still. This is to help staff to see the reason why someone has been locked out.
Yep, looks I read that comment totally wrong! Maybe next time I'm surprised reading something I should slow down and just re-read the comments... 😅. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #20 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Fridolin Somers from comment #6)
Reset login attempts as been asked by the library, this is a new feature. I hope it makes sens, otherwise I may create a new bug report.
As noted above, please remove that part here. It needs more attention too. See earlier comments. Thanks. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37512 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 [Bug 37512] Add a function to reset login attempts -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #145878|0 |1 is obsolete| | Attachment #147683|0 |1 is obsolete| | --- Comment #21 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 169844 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169844&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page Note: making QA obsolete too since it refers to a part of code removed from this bug -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #145503|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED --- Comment #22 from Fridolin Somers <fridolin.somers@biblibre.com> --- Thanks a lot Baptiste. Some little things to fix : patron.account_locked) %] => patron.account_locked ) %] <span class="circ-hlt">Locked: </span></span> => <span class="circ-hlt">Locked: </span><span> right ? <a href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]">Change password</a> You need to use URI filter : https://template-toolkit.org/docs/manual/Filters.html#section_uri -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|fridolin.somers@biblibre.co |baptiste.wojtkowski@biblibr |m |e.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #23 from David Cook <dcook@prosentient.com.au> --- This is looking good at a glance! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169844|0 |1 is obsolete| | --- Comment #24 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 169853 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169853&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169853|0 |1 is obsolete| | --- Comment #25 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 169864 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169864&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #26 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Caroline Cyr La Rose from comment #0)
Also, there is no button to change the password next to the warning. When a patron has unpaid fines or is in the wrong category, there is a button to either pay/writeoff the fines or change the category next to the warning. I would add a button that says 'Change password' next to the locked account warning. This might be outside the scope of this bug, but I think it would improve usability.
Incidentally, just sent you a message about this topic on Mattermost ;) The normal lock could be resolved by the patron him/herself via password reset. Should we add a button to let staff do what a patron can do? Not sure :) The administrative lockout cannot be removed by a patron. So we should perhaps add the button there only. But perhaps it needs a bit more text? This lockout is there for some reason, a staff member should definitely not remove it without further thought? Please add your feedback. The patch somehow needs some tweaking still. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #27 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- (In reply to Marcel de Rooy from comment #26)
(In reply to Caroline Cyr La Rose from comment #0)
Also, there is no button to change the password next to the warning. When a patron has unpaid fines or is in the wrong category, there is a button to either pay/writeoff the fines or change the category next to the warning. I would add a button that says 'Change password' next to the locked account warning. This might be outside the scope of this bug, but I think it would improve usability.
Incidentally, just sent you a message about this topic on Mattermost ;)
The normal lock could be resolved by the patron him/herself via password reset. Should we add a button to let staff do what a patron can do? Not sure :)
Imo we should. I feel like the use case for such a button is: a borrower comes to a librarian because they don't know what to do, the librarian looks at the account, see the message, and is happy to have access to the button right there on the sentence. We are not adding right to the staff member, since they already have this right. Last but not least: there is a Syspref OpacResetPassword which may prevent users from being allowed to reset their password, hence users must come to the librarian to reset their password. + I haven't checked but it would look very weird to me to be able to remove a security lock as a anonymous user, I'd rather remove the password reset functionality in such case, don't you think ?
The administrative lockout cannot be removed by a patron. So we should perhaps add the button there only. But perhaps it needs a bit more text? This lockout is there for some reason, a staff member should definitely not remove it without further thought?
I don't get why there would be a button in this case, like a button to see the fines or something so ?
Please add your feedback. The patch somehow needs some tweaking still.
-- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #28 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- (In reply to Marcel de Rooy from comment #26)
(In reply to Caroline Cyr La Rose from comment #0)
Also, there is no button to change the password next to the warning. When a patron has unpaid fines or is in the wrong category, there is a button to either pay/writeoff the fines or change the category next to the warning. I would add a button that says 'Change password' next to the locked account warning. This might be outside the scope of this bug, but I think it would improve usability.
Incidentally, just sent you a message about this topic on Mattermost ;)
I made a merge request for the manual (https://gitlab.com/koha-community/koha-manual/-/merge_requests/974). Hopefully it is clear... I did some testing to really understand these two "locks". "Lock": Created by the FailedLoginAttempts syspref. Can be removed by the patron by resetting their password (if OpacResetPassword is on), or by staff manually changing the password, or by staff sending a password recovery email (if OpacResetPassword is on). "Administrative lock: Created by the LockExpiredDelay syspref and cleanup_database cron job. Can be removed by staff manually changing the password, or by staff sending a password recovery email (if OpacResetPassword is on). The patron cannot ask for a recovery email through the OPAC (at least, it didn't work for me).
The normal lock could be resolved by the patron him/herself via password reset. Should we add a button to let staff do what a patron can do? Not sure :)
It can also be removed by manually changing the password from the staff interface. So a button on the staff side would still be useful.
The administrative lockout cannot be removed by a patron. So we should perhaps add the button there only. But perhaps it needs a bit more text? This lockout is there for some reason, a staff member should definitely not remove it without further thought?
Please add your feedback. The patch somehow needs some tweaking still.
Maybe the easiest solution would be a tooltip? Just to let staff know what is happening and how they can resolve it. Any staff who can edit patron accounts can change passwords. They can already do this, the button would simply be a shortcut. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #29 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- I'd be happy to keep taking over that patch but I am not sure of the work that has to be done are we okay about following changes ? 1 - Button for password reset is kept for "Lock" and text (tooltip ?) explains that resetting password will solve the pb 2 - For administrative lock, we add a tooltip to explain the librarian they can reset the password ? Shouldn't we then have a button in both cases since the action proposed to the librarian is twice the same ? I'm a bit lost /o/ -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #30 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Baptiste Wojtkowski (bwoj) from comment #29)
I'd be happy to keep taking over that patch but I am not sure of the work that has to be done are we okay about following changes ?
1 - Button for password reset is kept for "Lock" and text (tooltip ?) explains that resetting password will solve the pb 2 - For administrative lock, we add a tooltip to explain the librarian they can reset the password ?
Shouldn't we then have a button in both cases since the action proposed to the librarian is twice the same ? I'm a bit lost /o/
Yes, it seems so ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #31 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 174271 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174271&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outriste the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174271|0 |1 is obsolete| | --- Comment #32 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 174272 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174272&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outside the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Imani <imani.thomas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Imani <imani.thomas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174272|0 |1 is obsolete| | --- Comment #33 from Imani <imani.thomas@bywatersolutions.com> --- Created attachment 176212 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176212&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outside the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit Signed-off-by: Imani Thomas <imani.thomas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #34 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- FAIL koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc FAIL tidiness File is not tidy, please run `perl misc/devel/tidy.pl koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc` -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169864|0 |1 is obsolete| | Attachment #176212|0 |1 is obsolete| | --- Comment #35 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 178534 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178534&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #36 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 178535 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178535&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outside the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit Signed-off-by: Imani Thomas <imani.thomas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #37 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 178536 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178536&action=edit Bug 25947: (follow-up) Tidiness fix -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #38 from David Cook <dcook@prosentient.com.au> --- Just a reminder that "Patron's account has been locked (due to 3 failed login attempts)" will be flagged as a security problem by a professional penetration test. We should have a system preference for this, so that people can turn it off if prompted by security experts. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #39 from David Cook <dcook@prosentient.com.au> --- Actually, disregard my previous comment. I think that I misunderstood this change (like I often due when I see it). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Improve locked account |Improve locked account |message |message (on patron detail | |page) --- Comment #40 from David Cook <dcook@prosentient.com.au> --- Updated the title to prevent further misunderstandings about the nature of this change -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Improve locked account |Improve locked account |message (on patron detail |message in the staff |page) |interface --- Comment #41 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to David Cook from comment #39)
Actually, disregard my previous comment. I think that I misunderstood this change (like I often due when I see it).
Yes, it's for staff interface, not for the OPAC. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #42 from David Cook <dcook@prosentient.com.au> --- (In reply to Katrin Fischer from comment #41)
(In reply to David Cook from comment #39)
Actually, disregard my previous comment. I think that I misunderstood this change (like I often due when I see it).
Yes, it's for staff interface, not for the OPAC.
No the key part is that it's not for the "login page" but is rather for the "detail page", so that only authenticated staff users will see the message. It's not a message that an unauthenticated and unauthorized user will see. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #43 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #42)
(In reply to Katrin Fischer from comment #41)
(In reply to David Cook from comment #39)
Actually, disregard my previous comment. I think that I misunderstood this change (like I often due when I see it).
Yes, it's for staff interface, not for the OPAC.
No the key part is that it's not for the "login page" but is rather for the "detail page", so that only authenticated staff users will see the message. It's not a message that an unauthenticated and unauthorized user will see.
I'd argue that the new title "Improve locked account message in the staff interface" is the same level of misleading/confusing as it was before I changed it to "Improve locked account message (on patron detail page)". Perhaps "Improve locked account message on staff interface patron detail page" would be the most accurate. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Improve locked account |Improve locked account |message in the staff |message in brief patron |interface |info in staff interface --- Comment #44 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I changed it because the message shows on all pages of the patron account, not only the patron detail page. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #178535|0 |1 is obsolete| | --- Comment #45 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179441 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179441&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outside the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit Signed-off-by: Imani Thomas <imani.thomas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #46 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Span without content was incorrectly introduced with <span />, which breaks Bug 37512, I simply removed it and added a <span> </span>, letting in SO status -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Thibault Keromnès <thibault.keromnes@univ-paris8.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Patch doesn't apply CC| |thibault.keromnes@univ-pari | |s8.fr --- Comment #47 from Thibault Keromnès <thibault.keromnes@univ-paris8.fr> --- error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #178534|0 |1 is obsolete| | --- Comment #48 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179483 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179483&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179441|0 |1 is obsolete| | --- Comment #49 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179484 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179484&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outside the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit Signed-off-by: Imani Thomas <imani.thomas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #178536|0 |1 is obsolete| | --- Comment #50 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179485 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179485&action=edit Bug 25947: (follow-up) Tidiness fix -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179483|0 |1 is obsolete| | --- Comment #51 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 180567 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180567&action=edit Bug 25947: Improve locked account message When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages * a link to change password Links are only displayed if libarian has permission to edit patrons. For administrative lock, only a message is displayed : "Patron's account has been administratively locked" To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Change password", you go to change password page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179484|0 |1 is obsolete| | --- Comment #52 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 180568 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180568&action=edit Bug 25947: (follow-up) Improve locked account message Test plan: To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)". Note there is a tooltip at the right 6. Click on "Change password", you go to change password page Note: the follow-up might be unclear to understand: 1 - it moves the button outside the IF patron.login_attempt < 0 2 - Hence it requires the </li> to be moved out so button remains on the lane 3 - Finally the <li> must be put before the if and changed a bit Signed-off-by: Imani Thomas <imani.thomas@bywatersolutions.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179485|0 |1 is obsolete| | --- Comment #53 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 180569 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180569&action=edit Bug 25947: (follow-up) Tidiness fix Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA CC| |emily.lamancusa@montgomeryc | |ountymd.gov QA Contact|m.de.rooy@rijksmuseum.nl |emily.lamancusa@montgomeryc | |ountymd.gov -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39686 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 --- Comment #54 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00 |25.05.00,24.11.08 released in| | Status|Pushed to main |Pushed to stable --- Comment #55 from Fridolin Somers <fridolin.somers@biblibre.com> --- Nice little enhancement, I backport Pushed to 24.11.x for 24.11.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #56 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x as it wasn't backported to 24.05.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org