https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43898 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |33905 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33905 [Bug 33905] A patron's username and cardnumber must each not be used by another patron in any permutation -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43898 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=43896 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43898 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 209719 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209719&action=edit Bug 43898: Prevent patrons from using another patron's cardnumber as userid and vice versa Patrons can log in with either their userid or their cardnumber, but Koha only checks each field for uniqueness against itself. So one patron's userid can be another patron's cardnumber, and a login can match the wrong patron. This patch makes has_valid_userid reject a userid that is another patron's cardnumber, and the cardnumber policy reject a cardnumber that is another patron's userid. Only new or changed values are checked, so existing conflicts don't block logins or edits. A patron can still use the same value for their own userid and cardnumber. Test Plan: 1) Apply this patch 2) Restart all the things! 3) Edit any patron other than the koha user, set the username to 42 ( the koha user's card number ) 4) Note the "Username already exists" error! 5) Edit the same patron, set the card number to koha ( the koha user's username ) 6) Note the "Card number already in use" error! 7) prove t/db_dependent/Koha/Patrons.t t/db_dependent/Koha/Policy/Patrons/Cardnumber.t -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43898 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43898 --- Comment #3 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 209859 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209859&action=edit Bug 43898: Prevent patrons from using another patron's cardnumber as userid and vice versa Patrons can log in with either their userid or their cardnumber, but Koha only checks each field for uniqueness against itself. So one patron's userid can be another patron's cardnumber, and a login can match the wrong patron. This patch makes has_valid_userid reject a userid that is another patron's cardnumber, and the cardnumber policy reject a cardnumber that is another patron's userid. Only new or changed values are checked, so existing conflicts don't block logins or edits. A patron can still use the same value for their own userid and cardnumber. Test Plan: 1) Apply this patch 2) Restart all the things! 3) Edit any patron other than the koha user, set the username to 42 ( the koha user's card number ) 4) Note the "Username already exists" error! 5) Edit the same patron, set the card number to koha ( the koha user's username ) 6) Note the "Card number already in use" error! 7) prove t/db_dependent/Koha/Patrons.t t/db_dependent/Koha/Policy/Patrons/Cardnumber.t Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.