From 601e2d9baf76b4c2a0cbdcceee772e46b4c35a2a Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 4 Jan 2022 16:05:14 +1100 Subject: [PATCH] Bug 29783: Add account lockout patron userid lookup condition This patch checks that $q_userid is not blank before trying to do a patron lookup. This prevents a spurrious account locked message from appearing to the user when there is a user in Koha that has an empty userid and too many login_attempts. Test plan: 0) Do not apply the patch yet 1) Set system preference FailedLoginAttempts to 3 2) Modify a borrower to have an empty userid and 10 login_attempts e.g. update borrowers set userid = '', login_attempts = 10 where cardnumber = 23529001223636; 3) Visit the staff interface (e.g. http://localhost:8081/) 4) Note the message "Error: This account has been locked!" even though you have not tried to log in 5) Apply the patch 6) Visit the staff interface (e.g. http://localhost:8081/) 7) Note that there is no error message about your account being locked 8) Profit. --- C4/Auth.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 1cfeed48cc..73964f8fc8 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1272,7 +1272,7 @@ sub checkauth { push @inputs, { name => $name, value => $_ } for @value; } - my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! + my $patron = Koha::Patrons->find({ userid => $q_userid }) if $q_userid; # Not necessary logged in! my $LibraryNameTitle = C4::Context->preference("LibraryName"); $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; -- 2.26.2