When logging in via cas no userid is passed to checkpw, however, we still seek out users with a null userid/cardnumber. If one of those users has a locked account and it happens to be the one chosen, we won't continue to CAS/Shib login (or LDAP, but LDAP shouldn't get a blank userid)
Created attachment 93847 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds
Created attachment 93860 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds
Created attachment 93951 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu>
Created attachment 94018 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Works well, Passing QA
Nice work! Pushed to master for 19.11.00
Pushed to 19.05.x for 19.05.05