Bug 12227 - Remove demo user functionality
Summary: Remove demo user functionality
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 29056
  Show dependency treegraph
 
Reported: 2014-05-09 15:51 UTC by Galen Charlton
Modified: 2021-09-20 10:55 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 12227: Remove the demo functionality (18.48 KB, patch)
2017-09-27 17:39 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 12227: Remove the demo functionality (18.49 KB, patch)
2017-10-04 21:06 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 12227: Remove the demo functionality (18.54 KB, patch)
2017-10-30 10:21 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2014-05-09 15:51:57 UTC
There is a legacy authentication mode whereby if you enable a "demo" setting in koha-conf.xml, one can log in as a user with username "demo" and password "demo".

This user acts as a superlibrarian with two exceptions:

[1] not able to modify system preferences
[2] not able to save changes to MARC frameworks

This represents a wart in the authentication code for a very limited use case -- and warts in authentication code can turn into security exposures.

The special case should be removed.  If folks still want to be able to create demo systems with high-privilege staff accounts that can't touch MARC frameworks or system preferences, that can be addressed by adding a couple more granular permissions.
Comment 1 Martin Renvoize 2014-12-31 07:10:47 UTC
I spotted this code recently and can only agree that it's a nasty case, with agreement I'de be more than happy to strip it out.
Comment 2 Jonathan Druart 2017-09-27 17:39:51 UTC
Created attachment 67407 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.
Comment 3 Alex Buckley 2017-10-04 02:21:56 UTC
What is the demo setting in koha-conf.xml that needs to be enabled? I cannot find the string 'demo' in the aforementioned file
Comment 4 Jonathan Druart 2017-10-04 15:53:33 UTC
(In reply to Alex Buckley from comment #3)
> What is the demo setting in koha-conf.xml that needs to be enabled? I cannot
> find the string 'demo' in the aforementioned file

This patch removes the demo functionality. It has never been implemented fully, it is expected not to see it in the config file.
Comment 5 Alex Buckley 2017-10-04 21:06:30 UTC
Created attachment 67617 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Comment 6 Kyle M Hall 2017-10-30 10:21:50 UTC
Created attachment 68837 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Jonathan Druart 2017-12-11 14:35:12 UTC
Pushed to master for 18.05, thanks to everybody involved!
Comment 8 Nick Clemens 2017-12-14 17:46:23 UTC
Awesome work all! Skipping for 17.11, enhancement.
Comment 10 Andrii Nugged 2021-09-20 08:22:10 UTC
(above comment re-posted from my words by JD, we had some antispam issues)

found some remnants of "C4::Context->config('demo')": 
in /svc/config/systempreferences line 68:

`unless ( C4::Context->config('demo') ) { ... `

it's never failing because it returns _REFERENCE_TO_HASH_, even the hash is empty:


```
sub set_preferences {
    warn C4::Context->config( 'demo' );
    warn C4::Context->config( 'demo' ) ? 'TRUTH' : 'FALSE';
    warn Dumper(C4::Context->config( 'demo' ));

    unless ( C4::Context->config('demo') ) {
        ...
```

Gives:
[2021/09/20 10:42:56] [WARN] HASH(0x5646ead56e00)
[2021/09/20 10:42:56] [WARN] TRUTH
[2021/09/20 10:42:56] [WARN] $VAR1 = {};

and despite this "hash truth" issue
also, by the way, as I see, this "demo" was removed everywhere so should be in svc/config/systempreferences too.
Comment 11 Andrii Nugged 2021-09-20 10:55:41 UTC
Created Bug 29056