If Patron is declared as lost card it might be better not to allow an authentication, so that no renewal of holds can be made.
Created attachment 89830 [details] [review] Bug 22925 : Disable ILS-DI AuthenticatePatron if patron has lost card. test plan: 1 / set a patron as card lost in the intranet 2 / query ILS-DI with login and password -> should respond with borrowernumber 3 / apply patch 4 / Repeat 2, should respond code "PatronLostCard"
Hi Arthur, Can you explain a bit more about the use case here? Since this is ILS-DI only, and not across all of the Koha OPAC, I assume your use case has to do with connectivity to a service like Overdrive or Bolinda (or your local eBook vendor). Is that right? The reason I ask is because not every library uses the cardnumber as the login username. A person who loses their card may still have a legitimate reason to log into Koha (or an attached 3rd party service) - why should they be additionally punished for losing their card by not being able to access library resources? People lose things all the time and it's really annoying to replace all those lost things. Let's not make it harder for people. The information on the majority of library cards is basically considered public - things like your name, and your card number. They aren't secret. The password though, is. And since (I sure hope...) normally the password isn't on the library card, even if someone bad has the card, they still don't have the password and so can't get in anyway. Taking it a step further, even if the bad person went to the OPAC to change the password (presuming the library has that enabled), they would still need the username (that could be the card number, yes, but it often isn't) and/or the e-mail address associated with the account, and access to that email account, to change the password. Yes, they could then get in to the 3rd party service, but they have worked really hard to get there and compromised much more than just Koha, and likely broken a few laws in the mean time. If we are going to implement this feature, I feel like it must be optional, and definitely should be off by default. Please, if anybody thinks any of this is wrong, I'm happy to consider that point of view - I am sure I haven't thought through to every possibility and there could be a very good use case for this feature. Cheers, Liz
Hi Liz, I get your point :) Maybe yet another syspref similar to what "BlockExpiredPatronOpacActions" does but for "lost card" flag instead of "expired" flag? But then that would touch also the Web interface and not only the WebService. Probably need to create a new bug and close that one in that case. What would you think about this? Arthur PS : I've also translated and forwarded your arguments to our partner see if they can find a workaround...
Closing discussion, Liz is quite right, let's not annoy users. It's ok for people to login to their services although they have lost their cards. If one worry about the cardnumber being used in a fraudulent way, password can be changed.