[Bug 43896] New: Patrons can't log in with a cardnumber that matches another patron's userid
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 Bug ID: 43896 Summary: Patrons can't log in with a cardnumber that matches another patron's userid Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: martin.renvoize@openfifth.co.uk CC: dpavlin@rot13.org Target Milestone: --- Since bug 40286, checkpw_internal only checks the password of the patron whose userid matches the login. If that string is also another patron's cardnumber, the cardnumber owner can no longer log in with their own password. Before 26.05 Koha fell back to the cardnumber match, so logins that worked for years break on upgrade. Each failed attempt also increments login_attempts on the userid owner. This affects everything that goes through C4::Auth::checkpw To recreate: 1) Create patron A with cardnumber TESTCARD and a password 2) Create patron B with userid TESTCARD and a different password 3) Log into the OPAC as TESTCARD with patron A's password 4) Note "You entered an incorrect username or password" 5) Note patron B's login_attempts went up -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |40286 See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=33905 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40286 [Bug 40286] Make C4::Auth::checkpw_internal use Koha::Patrons->find_by_identifier -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 208826 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208826&action=edit Bug 43896: Unit tests Patch from commit d0dccba -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 --- Comment #2 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 208827 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208827&action=edit Bug 43896: Patrons can't log in with a cardnumber that matches another patron's userid Bug 40286 made checkpw_internal use Koha::Patrons->find_by_identifier, which only returns the userid match when an identifier is one patron's userid and another patron's cardnumber. Before that, Koha tried the userid match and then the cardnumber match. Now the cardnumber owner can't log in with their own password, and each attempt counts as a failed login on the other patron. This patch restores the cardnumber fallback when the password doesn't match. Test Plan: 1) Apply the unit test patch 2) prove t/db_dependent/Auth.t 3) Note the test failures 4) Apply this patch 5) prove t/db_dependent/Auth.t 6) All tests pass! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #208826|0 |1 is obsolete| | Attachment #208827|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 208831 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208831&action=edit Bug 43896: Unit tests Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 --- Comment #4 from David Nind <david@davidnind.com> --- Created attachment 208832 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208832&action=edit Bug 43896: Patrons can't log in with a cardnumber that matches another patron's userid Bug 40286 made checkpw_internal use Koha::Patrons->find_by_identifier, which only returns the userid match when an identifier is one patron's userid and another patron's cardnumber. Before that, Koha tried the userid match and then the cardnumber match. Now the cardnumber owner can't log in with their own password, and each attempt counts as a failed login on the other patron. This patch restores the cardnumber fallback when the password doesn't match. Test Plan: 1) Apply the unit test patch 2) prove t/db_dependent/Auth.t 3) Note the test failures 4) Apply this patch 5) prove t/db_dependent/Auth.t 6) All tests pass! Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #5 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. To reproduced the issue using: - Mary Burton (49): . Card number: TESTCARD . User name: 23529000651225 . Password: Policy10 - Lisa Charles (37): . Card number: 23529000197047 . User name: TESTCARD . Password: Policy09 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com --- Comment #6 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- There are a couple efforts to entirely avoid this situation to happen. Not sure what we want to do, really. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=43898 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org