Summary: | Set borrower password on first login from self registration | ||
---|---|---|---|
Product: | Koha | Reporter: | Liz Rea <liz> |
Component: | OPAC | Assignee: | Bugs List <koha-bugs> |
Status: | Failed QA --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | arm, laurence.rault, m.de.rooy, mtompset, severine.queune |
Version: | Main | Keywords: | Academy |
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Attachments: |
Bug-19660: Set password after self registration
Bug-19960: Fix password field Bug 19660: Set password after self registration Bug 19660: Follow up to fix password field on the registration page |
Description
Liz Rea
2017-11-21 03:27:45 UTC
Created attachment 70596 [details] [review] Bug-19660: Set password after self registration Test plan: 1. Enable PatronSelfRegistration 2. Add a PatronSelfRegistrationDefaultCategory too 3. In OPAC register a user 4. Without patch after hitting submit, password is displayed onscreen 5. After applying patch, password is changed afterwards by sending a email 6. Note how primary email is required Notes - Email is now required for this to work since a unique key was needed for password-recovery.pl to work - A password is randomly generated for the user Created attachment 70727 [details] [review] Bug-19960: Fix password field This is a follow up patch to fix the password field on the registration complete page. Please upload this patch along with the previous version :) Test plan: 1. Apply this patch 2. The password field has the pregenerated password if the syspref is enabled 3. Before the patch the password was displayed on the screen in a span tag Tested ok following test plan, ready to be signeoff Impossible to signoff from the sandbox : It seems you don't have applied a patch, so you cannot sign it off. If you applied patches from the right report, check the commit message of the last patch. It should start with "Bug XXXXX", if not, please inform the author of the patch. These system preferences need setting from a base kohadevbox: OpacResetPassword - Allowed -- otherwise you get almost done, and then it won't let you check it, because reset isn't allowed. PatronSelfRegistration - Allow -- otherwise, you can't even start. PatronSelfRegistrationDefaultCategory - Anything valid, otherwise you may have a crash somewhere. PatronSelfRegistrationPrefillForm -- MMmmm... something isn't right with this now. It works as expected, but something about this leaves a bad taste in my mouth. Created attachment 72900 [details] [review] Bug 19660: Set password after self registration Test plan: 1. Enable PatronSelfRegistration 2. Add a PatronSelfRegistrationDefaultCategory too 3. In OPAC register a user 4. Without patch after hitting submit, password is displayed onscreen 5. After applying patch, password is changed afterwards by sending a email 6. Note how primary email is required Notes - Email is now required for this to work since a unique key was needed for password-recovery.pl to work - A password is randomly generated for the user Signed-off-by: Laurence Rault <laurence.rault@biblibre.com> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Created attachment 72901 [details] [review] Bug 19660: Follow up to fix password field on the registration page This is a follow up patch to fix the password field on the registration complete page. Please upload this patch along with the previous version :) Test plan: 1. Apply this patch 2. The password field has the pregenerated password if the syspref is enabled 3. Before the patch the password was displayed on the screen in a span tag Signed-off-by: Laurence Rault <laurence.rault@biblibre.com> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> vertification_legend ? QA: Looking here I have the feeling that we are not ready yet. As Mark already stated, this feature does not work when pref ResetPassword has not been enabled. But since that is possible, we should make it work somehow? Currently when off, you can enter your email address. You will directly see: You can't reset your password. But I also got an email with a reset link. Clicking that link gives also: You can't reset your password. Apart from ResetPassword dependence, if the registration is complete, I think that the form is still a bit confusing. Entering an email is optional and password is prefilled. If I just click Login, I am in but I do not know my password. Why don't we add a New password field on the Completion form? Then the user is forced to enter a new password AND we do not rely on the Reset functionality that may be disabled altogether? (Or add the password already on the first registraton form memberentry?) Note that without digging thru all registration options, I got the option to create a Staff user in the self registration form. I think we should not offer that. Outside scope here though. Changing status. Librarian point of view - As M Tomsett says, this method cannot work properly without an email address. The email field should not be required - especially now with so many countries requiring specific opt-in permission from the user to send them email. However, it should be possible for people to use online services without giving an email address. I agree with Marcel that the ideal solution is to have the user enter password (hidden, twice for verification) in the registration form. Then, let the email address be optional, as a library set preference. (In reply to Agnes Rivers-Moore from comment #10) > Librarian point of view - > As M Tomsett says, this method cannot work properly without an email > address. The email field should not be required - especially now with so > many countries requiring specific opt-in permission from the user to send > them email. > However, it should be possible for people to use online services without > giving an email address. > I agree with Marcel that the ideal solution is to have the user enter > password (hidden, twice for verification) in the registration form. Then, > let the email address be optional, as a library set preference. The problem with an optional email address on self registration is that you have no means to verify that the user registering is a real person. It would open self registrations up to bots and pranks. (In reply to Katrin Fischer from comment #11) > (In reply to Agnes Rivers-Moore from comment #10) > > Librarian point of view - > > As M Tomsett says, this method cannot work properly without an email > > address. The email field should not be required - especially now with so > > many countries requiring specific opt-in permission from the user to send > > them email. > > However, it should be possible for people to use online services without > > giving an email address. > > I agree with Marcel that the ideal solution is to have the user enter > > password (hidden, twice for verification) in the registration form. Then, > > let the email address be optional, as a library set preference. > > The problem with an optional email address on self registration is that you > have no means to verify that the user registering is a real person. It would > open self registrations up to bots and pranks. I am not sure existence of an email address proves a genuine individual or protects from pranking or misuse. If a library needs to prove there is a real person who is not already registered, or banned, or from another country, they would need more than an email address. Our staff see the online registration attempt and contact the person for ID verification. So, library set preference for whether email is required or not. For us, phone number required is more important. (In reply to Agnes Rivers-Moore from comment #12) > I am not sure existence of an email address proves a genuine individual or > protects from pranking or misuse. If a library needs to prove there is a > real person who is not already registered, or banned, or from another > country, they would need more than an email address. Our staff see the > online registration attempt and contact the person for ID verification. So, > library set preference for whether email is required or not. For us, phone > number required is more important. If you enable the verification step for self registration (and imo you should always do that), you need an email address. |