[Bug 37104] New: Block AnonymousPatron from logging into anything
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Bug ID: 37104 Summary: Block AnonymousPatron from logging into anything Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: lucas@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org In Bug 36679 we blocked the AnonymousPatron from logging into SCO. The AnonymousPatron should not log in to anything, staff interface/OPAC/SCO. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |36679 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 [Bug 36679] anonymous patron is not blocked from checkout via self check -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |samalau@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #1 from Sam Lau <samalau@gmail.com> --- Created attachment 167793 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167793&action=edit Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. To test: 1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. 2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") 3) Ensure that you know the username and password for this patron and can log in. 4) Visit the OPAC, attempt to log-in with your anon patron. 5) Note that you can log in and nothing happens. 6) Visit the staff interface, attempt to log-in with anon patron. 7) Once again, note that you are able to log-in with no issue. 8) Apply patch and restart_all 9) Attempt to log into the OPAC and staff interface with the patron again. 10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167793|0 |1 is obsolete| | --- Comment #2 from Sam Lau <samalau@gmail.com> --- Created attachment 167795 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167795&action=edit Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. To test: 1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. 2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") 3) Ensure that you know the username and password for this patron and can log in. 4) Visit the OPAC, attempt to log-in with your anon patron. 5) Note that you can log in and nothing happens. 6) Visit the staff interface, attempt to log-in with anon patron. 7) Once again, note that you are able to log-in with no issue. 8) Apply patch and restart_all 9) Attempt to log into the OPAC and staff interface with the patron again. 10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167795|0 |1 is obsolete| | --- Comment #3 from Sam Lau <samalau@gmail.com> --- Created attachment 167798 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167798&action=edit Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. To test: 1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. 2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") 3) Ensure that you know the username and password for this patron and can log in. 4) Visit the OPAC, attempt to log-in with your anon patron. 5) Note that you can log in and nothing happens. 6) Visit the staff interface, attempt to log-in with anon patron. 7) Once again, note that you are able to log-in with no issue. 8) Apply patch and restart_all 9) Attempt to log into the OPAC and staff interface with the patron again. 10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #4 from Sam Lau <samalau@gmail.com> --- Created attachment 167801 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167801&action=edit Bug 37104: (Follow up) Restructure checkpw code -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #5 from Sam Lau <samalau@gmail.com> --- Created attachment 167802 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167802&action=edit Bug 37104: Unit tests prove t/db-dependent/Auth.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167798|0 |1 is obsolete| | --- Comment #6 from David Nind <david@davidnind.com> --- Created attachment 167811 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167811&action=edit Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. To test: 1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. 2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") 3) Ensure that you know the username and password for this patron and can log in. 4) Visit the OPAC, attempt to log-in with your anon patron. 5) Note that you can log in and nothing happens. 6) Visit the staff interface, attempt to log-in with anon patron. 7) Once again, note that you are able to log-in with no issue. 8) Apply patch and restart_all 9) Attempt to log into the OPAC and staff interface with the patron again. 10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167801|0 |1 is obsolete| | --- Comment #7 from David Nind <david@davidnind.com> --- Created attachment 167812 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167812&action=edit Bug 37104: (Follow up) Restructure checkpw code Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167802|0 |1 is obsolete| | --- Comment #8 from David Nind <david@davidnind.com> --- Created attachment 167813 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167813&action=edit Bug 37104: Unit tests prove t/db-dependent/Auth.t Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This prevents the anonymous release notes| |patron from logging into | |the OPAC and staff | |interface (set using the | |AnonymousPatron system | |preference). --- Comment #9 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. To run the tests (underscore, rather than a dash): prove t/db_dependent/Auth.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This prevents the anonymous |This prevents the anonymous release notes|patron from logging into |patron from logging into |the OPAC and staff |the OPAC and staff |interface (set using the |interface. (The anonymous |AnonymousPatron system |patron used for anonymous |preference). |suggestions and checkout | |history is set using the | |AnonymousPatron system | |preference.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167813|0 |1 is obsolete| | --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 168268 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168268&action=edit Bug 37104: Unit tests prove t/db-dependent/Auth.t Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167811|0 |1 is obsolete| | --- Comment #11 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 168269 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168269&action=edit Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. To test: 1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. 2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") 3) Ensure that you know the username and password for this patron and can log in. 4) Visit the OPAC, attempt to log-in with your anon patron. 5) Note that you can log in and nothing happens. 6) Visit the staff interface, attempt to log-in with anon patron. 7) Once again, note that you are able to log-in with no issue. 8) Apply patch and restart_all 9) Attempt to log into the OPAC and staff interface with the patron again. 10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167812|0 |1 is obsolete| | --- Comment #12 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 168270 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168270&action=edit Bug 37104: (Follow up) Restructure checkpw code Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Status|Signed Off |Passed QA QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com --- Comment #13 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks Sam, all working as expected now. QA scripts happy and unit tests passing. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- my $is_anonymous_patron = $patron && ( $patron->borrowernumber eq $anonymous_patron ); Why not use == instead of eq? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed CC| |jonathan.druart@gmail.com --- Comment #16 from Jonathan Druart <jonathan.druart@gmail.com> --- Found a new warning that seems related to this change. [WARN] Use of uninitialized value $anonymous_patron in string eq at /kohadevbox/koha/C4/Auth.pm line 2065. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #17 from Sam Lau <samalau@gmail.com> --- Created attachment 168592 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168592&action=edit Bug 37104: (Follow up) Checks for unitialized value of 'anonymous_patron' system pref -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #18 from Sam Lau <samalau@gmail.com> --- (In reply to Jonathan Druart from comment #16)
Found a new warning that seems related to this change.
[WARN] Use of uninitialized value $anonymous_patron in string eq at /kohadevbox/koha/C4/Auth.pm line 2065.
The issue is due to the 'AnonymousPatron' system preference being a text entry bod, so it could be an empty string. Needed to first check if it is initialized. What do you think of this, Jonathan? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #19 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to Sam Lau from comment #18)
(In reply to Jonathan Druart from comment #16)
Found a new warning that seems related to this change.
[WARN] Use of uninitialized value $anonymous_patron in string eq at /kohadevbox/koha/C4/Auth.pm line 2065.
The issue is due to the 'AnonymousPatron' system preference being a text entry bod, so it could be an empty string. Needed to first check if it is initialized. What do you think of this, Jonathan?
Yes, but why did you replace '==' with 'eq'? It shouldn't make much differences, but the other occurrences are using eq. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168592|0 |1 is obsolete| | --- Comment #20 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 168666 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168666&action=edit Bug 37104: (Follow up) Checks for unitialized value of 'anonymous_patron' system pref Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> JD Amended patch: replace '==' with 'eq' for consistency with other occurrences. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168666|0 |1 is obsolete| | --- Comment #21 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 168694 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168694&action=edit Bug 37104: (Follow up) Checks for unitialized value of 'anonymous_patron' system pref Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> JD Amended patch: replace '==' with 'eq' for consistency with other occurrences. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|martin.renvoize@ptfs-europe | |.com | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 --- Comment #22 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I think I missed this follow-up - grabbing it now. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | --- Comment #23 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to Katrin Fischer from comment #22)
I think I missed this follow-up - grabbing it now.
I would add a search on > Pushed to Main that that have the "additional_work_needed" kw. Then it should be removed when you dealt with it :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #24 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #25 from Fridolin Somers <fridolin.somers@biblibre.com> --- Whoooo this is a big change, but makes sens. Some may use the anonymous patron to authenticate. I prefer not backport to 23.11 for stability. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #26 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not backported to 23.11.x Needs a big warn in doc :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #27 from David Nind <david@davidnind.com> --- Bug fix. No update to the documentation required. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Documentation| |https://gitlab.com/koha-com submission| |munity/koha-manual/-/merge_ | |requests/1056 Documentation| |David Nind contact| | --- Comment #28 from David Nind <david@davidnind.com> --- I changed my mind about the documentation changes required. I have now added a note to the system preference description about this change. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37104 Bug 37104 depends on bug 36679, which changed state. Bug 36679 Summary: Anonymous patron is not blocked from checkout via self check https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36679 What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org