While testing for oleonard at responsive.mykoha.co.nz, I found these steps duplicated a weird glitch. 1) go to responsive.mykoha.co.nz 2) log in The user is member, member 3) click the self checkout link 4) log in 5) click the browser back button twice 6) refresh page The user is now staff Similarly, 1) go to responsive.mykoha.co.nz 2) click the self checkout link 3) log in 4) click the finish button 5) change the address back to the http://responsive.mykoha.co.nz/ 6) refresh page The user is now staff The log in used was the member, member one, and not staff.
To trigger the problem in firefox for method one: 1) go to responsive.mykoha.co.nz 2) log in The user is member, member 3) copy the self checkout link 4) search for a book 5) view the details 6) paste the self checkout link 7) log in 8) click the browser back button twice 9) refresh page. Without actually being on a page past the log in, Firefox would resend the data and avoid this bug.
Note that this problem isn't a problem just with the demo system linked above, but with any system running master (or before, probably). In order to reproduce the problem you have to have the AutoSelfCheckAllowed preference set to "allow the web-based self checkout system to automatically login with this staff login..." and have staff login credentials saved. So it's not exactly the case that one is able to change the logged in user--the staff user must be logged in for the self checkout to work. It's more a question of whether there should be a built-in way to prevent the self checkout user from accessing a regular OPAC session.
Unless you lock your browser down, someone is likely to click back or paste things into the address bar. The self-checkout isn't really self-checkout, it is use this staff user for checkout. Sort of like a seteuid system implemented as a setuid instead of actually implementing a seteuid system.
*** This bug has been marked as a duplicate of bug 14298 ***
Created attachment 42232 [details] [review] Bug 10799: Limit the SCO user to the SCO module The SCO user should only be allowed to access to the SCO module. This patch make the session ends if the user tries to access another page after the SCO module. Test plan: 0/ Configure the SCO module correctly 1/ Go on the sco main page (sco/sco-main.pl) 2/ Try to go somewhere else: you should not be logged in
Created attachment 42233 [details] [review] Bug 10799: Remove "Welcome Sco user" When you are in the SCO module, there is no sense to display the "Welcome Sco user" and the logout link in the masthead. This patch removes it.
I am not familiar enough with this module to be confident with these patches, please be involved!
Comment on attachment 42232 [details] [review] Bug 10799: Limit the SCO user to the SCO module Review of attachment 42232 [details] [review]: ----------------------------------------------------------------- ::: C4/Auth.pm @@ +179,5 @@ > } > > + # If the user logged in is the SCO user and he tries to go out the SCO module, the log user out. > + if ( $in->{type} eq 'opac' and $in->{template_name} !~ m|sco/| ) { > + if ( $user eq C4::Context->preference('AutoSelfCheckID') ) { I know things have changed lately, but the preference() did in the past return undef as well as defined values. We don't want floody log noise. if ( C4::Context->preference('AutoSelfCheckID') and ($user eq C4::Context->preference('AutoSelfCheckID') ) ) {
Created attachment 42247 [details] [review] Bug 10799: Limit the SCO user to the SCO module The SCO user should only be allowed to access to the SCO module. This patch make the session ends if the user tries to access another page after the SCO module. Test plan: 0/ Configure the SCO module correctly 1/ Go on the sco main page (sco/sco-main.pl) 2/ Try to go somewhere else: you should not be logged in Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Works as advertised, the SelfCheck still works fine I made the tiny change Mark asked for to keep the logs quiet
Created attachment 42248 [details] [review] Bug 10799: Remove "Welcome Sco user" When you are in the SCO module, there is no sense to display the "Welcome Sco user" and the logout link in the masthead. This patch removes it. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(In reply to M. Tompsett from comment #8) > Comment on attachment 42232 [details] [review] [review] > Bug 10799: Limit the SCO user to the SCO module > > Review of attachment 42232 [details] [review] [review]: > ----------------------------------------------------------------- > > ::: C4/Auth.pm > @@ +179,5 @@ > > } > > > > + # If the user logged in is the SCO user and he tries to go out the SCO module, the log user out. > > + if ( $in->{type} eq 'opac' and $in->{template_name} !~ m|sco/| ) { > > + if ( $user eq C4::Context->preference('AutoSelfCheckID') ) { > > I know things have changed lately, but the preference() did in the past > return undef as well as defined values. We don't want floody log noise. > > if ( C4::Context->preference('AutoSelfCheckID') and ($user eq > C4::Context->preference('AutoSelfCheckID') ) ) { Default is "", shouldn't change anything.
The patch works, but there is a small glitch we need to fix: http://localhost/cgi-bin/koha/opac-user.pl Software error: Can't use an undefined value as an ARRAY reference at /usr/lib/perl5/DBI.pm line 2064. For help, please send mail to the webmaster (webmaster@bumblebee), giving this error message and the time and date of the error. When you try to login, an error message displays.
Created attachment 42516 [details] [review] Bug 10799: Limit the SCO user to the SCO module The SCO user should only be allowed to access to the SCO module. This patch make the session ends if the user tries to access another page after the SCO module. Test plan: 0/ Configure the SCO module correctly 1/ Go on the sco main page (sco/sco-main.pl) 2/ Try to go somewhere else: you should not be logged in
I have rewritten the patch to fix the comment 12's issue
The first patch does not apply, I think it is already covered by: Bug 14776 - SCO/shelfcheck 'log out' option redirects to OPAC, not back to SCO (Pushed to master)
Regarding the 2nd patch: Limit the SCO user to the SCO module I have sysprefs: AutoSelfCheckAllowed: [Allow} the web-based self checkout system to automatically login with this staff login ...and AutoSelfCheckID / AutoSelfCheckPass are set. In that case, I would not expect a login form but a redirect to the SCO page (with the SCO user logged in).
I'd consider that as an improvement, this one is a security fix.
Created attachment 44043 [details] [review] Bug 10799: Limit the SCO user to the SCO module The SCO user should only be allowed to access to the SCO module. This patch make the session ends if the user tries to access another page after the SCO module. Test plan: 0/ Configure the SCO module correctly 1/ Go on the sco main page (sco/sco-main.pl) 2/ Try to go somewhere else: you should not be logged in Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 44243 [details] [review] [PASSED QA] Bug 10799: Limit the SCO user to the SCO module The SCO user should only be allowed to access to the SCO module. This patch make the session ends if the user tries to access another page after the SCO module. Test plan: 0/ Configure the SCO module correctly 1/ Go on the sco main page (sco/sco-main.pl) 2/ Try to go somewhere else: you should not be logged in Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Patch pushed to master. Thanks Jonathan!
This patch has been pushed to 3.20.x, will be in 3.20.6.
Released in stable branches, moving out of security