Bug 12227

Summary: Remove demo user functionality
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: AuthenticationAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: alexbuckley, dpavlin, jonathan.druart, katrin.fischer, martin.renvoize, mtompset, nick, nugged
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19131
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 29056    
Attachments: Bug 12227: Remove the demo functionality
Bug 12227: Remove the demo functionality
Bug 12227: Remove the demo functionality

Description Galen Charlton 2014-05-09 15:51:57 UTC
There is a legacy authentication mode whereby if you enable a "demo" setting in koha-conf.xml, one can log in as a user with username "demo" and password "demo".

This user acts as a superlibrarian with two exceptions:

[1] not able to modify system preferences
[2] not able to save changes to MARC frameworks

This represents a wart in the authentication code for a very limited use case -- and warts in authentication code can turn into security exposures.

The special case should be removed.  If folks still want to be able to create demo systems with high-privilege staff accounts that can't touch MARC frameworks or system preferences, that can be addressed by adding a couple more granular permissions.
Comment 1 Martin Renvoize 2014-12-31 07:10:47 UTC
I spotted this code recently and can only agree that it's a nasty case, with agreement I'de be more than happy to strip it out.
Comment 2 Jonathan Druart 2017-09-27 17:39:51 UTC
Created attachment 67407 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.
Comment 3 Alex Buckley 2017-10-04 02:21:56 UTC
What is the demo setting in koha-conf.xml that needs to be enabled? I cannot find the string 'demo' in the aforementioned file
Comment 4 Jonathan Druart 2017-10-04 15:53:33 UTC
(In reply to Alex Buckley from comment #3)
> What is the demo setting in koha-conf.xml that needs to be enabled? I cannot
> find the string 'demo' in the aforementioned file

This patch removes the demo functionality. It has never been implemented fully, it is expected not to see it in the config file.
Comment 5 Alex Buckley 2017-10-04 21:06:30 UTC
Created attachment 67617 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Comment 6 Kyle M Hall 2017-10-30 10:21:50 UTC
Created attachment 68837 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Jonathan Druart 2017-12-11 14:35:12 UTC
Pushed to master for 18.05, thanks to everybody involved!
Comment 8 Nick Clemens 2017-12-14 17:46:23 UTC
Awesome work all! Skipping for 17.11, enhancement.
Comment 10 Andrii Nugged 2021-09-20 08:22:10 UTC
(above comment re-posted from my words by JD, we had some antispam issues)

found some remnants of "C4::Context->config('demo')": 
in /svc/config/systempreferences line 68:

`unless ( C4::Context->config('demo') ) { ... `

it's never failing because it returns _REFERENCE_TO_HASH_, even the hash is empty:


```
sub set_preferences {
    warn C4::Context->config( 'demo' );
    warn C4::Context->config( 'demo' ) ? 'TRUTH' : 'FALSE';
    warn Dumper(C4::Context->config( 'demo' ));

    unless ( C4::Context->config('demo') ) {
        ...
```

Gives:
[2021/09/20 10:42:56] [WARN] HASH(0x5646ead56e00)
[2021/09/20 10:42:56] [WARN] TRUTH
[2021/09/20 10:42:56] [WARN] $VAR1 = {};

and despite this "hash truth" issue
also, by the way, as I see, this "demo" was removed everywhere so should be in svc/config/systempreferences too.
Comment 11 Andrii Nugged 2021-09-20 10:55:41 UTC
Created Bug 29056