https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 --- Comment #1 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 131348 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131348&action=edit Bug 30199: self checkout login by cardnumber is broken if you input a non-existent cardnumber Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131348|0 |1 is obsolete| | --- Comment #2 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 131364 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131364&action=edit Bug 30199: self checkout login by cardnumber is broken if you input a non-existent cardnumber Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |major --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- As this is the area we just had the security fixes for, we might want to verify if this is related (I suspect it is) to make sure it gets backported to all the right versions. I am updating the severity as for a standalone self check station this could be quite an issue with no staff around to restart things. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com --- Comment #5 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Good catch, Kyle! Can you have a look at this alternative patch please? I think the correct fix is to not generate the JWT if the patron's info are not valid. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 --- Comment #7 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Lucas, Kyle, could you test this alternative patch? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131860|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kyle@bywatersolutions.com |jonathan.druart+koha@gmail. | |com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131973|0 |1 is obsolete| | --- Comment #10 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 131978 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131978&action=edit Bug 30199: Do not generate jwt if patron does not exist This is a follow-up patch for bug 29543. If an invalid cardnumber has been used we should not generate a token. Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131978|0 |1 is obsolete| | --- Comment #12 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 132183 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=132183&action=edit Bug 30199: Do not generate jwt if patron does not exist This is a follow-up patch for bug 29543. If an invalid cardnumber has been used we should not generate a token. Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |22.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 --- Comment #15 from Lucas Gass <lucas@bywatersolutions.com> --- If possible can we get this backported to 21.11 and 21.05? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Sarah Cornell <sbcornell@cityofportsmouth.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sbcornell@cityofportsmouth. | |com --- Comment #17 from Sarah Cornell <sbcornell@cityofportsmouth.com> --- We'd love to have this backported to 21.05 as soon as possible. It's starting to show up on machines that were previously well-behaved. Thanks! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|22.05.00,21.11.05 |22.05.00,21.11.05,21.05.15 released in| | CC| |andrew@bywatersolutions.com Status|Pushed to stable |Pushed to oldstable --- Comment #19 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Pushed to 21.05.x for 21.05.15 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #21 from wainuiwitikapark@catalyst.net.nz --- Does this need to be backported to 19.11.x? -- You are receiving this mail because: You are watching all bug changes.