Bug 31431 - Cannot change one's own userid if logged in as staff
Summary: Cannot change one's own userid if logged in as staff
Status: RESOLVED DUPLICATE of bug 33815
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-21 10:53 UTC by Joonas Kylmälä
Modified: 2023-06-17 11:42 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Joonas Kylmälä 2022-08-21 10:53:09 UTC
I cannot change the userid for my own account in the staff interface, if I do that I get the following error on any subsequent page I try to access:

> Can't use string ("Koha::Patron") as a HASH ref while "strict refs" in use at /kohadevbox/koha/Koha/Object.pm line 830

Could the user session be tied into a specific userid, and if that changes things break?
Comment 1 Katrin Fischer 2022-08-21 10:54:55 UTC
Hm I think this used to work, but after changing I usually needed to log in again being logged out.
Comment 2 Magnus Enger 2023-01-25 01:06:11 UTC
I can confirm this on 22.05.08. After changing my userid in the staff client, I could only get "Internal Server Error" whatever I clicked on.
Comment 3 Janusz Kaczmarek 2023-05-05 10:57:14 UTC
Same effect (Internal Server Error) in 22.11.03.  In log we find:

Can't call method "password_expired" on an undefined value at /usr/share/koha/lib/C4/Auth.pm line 1785.

This is because, in function C4::Auth::check_cookie_auth, the following is done:

            my $userid   = $session->param('id');
[...]
            my $patron = Koha::Patrons->find({ userid => $userid });
            $patron = Koha::Patrons->find({ cardnumber => $userid })
              unless $patron;
            return ("password_expired", undef ) if $patron->password_expired;

$userid is taken from stored session data and contains the old user login (= userid).  At the same time, the content of the borrowers table is already updated with the new userid.  So no patron object is found.  As a consequence, $patron->password_expired is called on an undefined patron (without checking if it exists).

So, maybe while self-modifying the userid the session data should also be updated?  Would it work?  And how about SSO methods, should any of them be used?
Comment 4 Katrin Fischer 2023-06-17 11:06:33 UTC

*** This bug has been marked as a duplicate of bug 33851 ***
Comment 5 Katrin Fischer 2023-06-17 11:42:41 UTC

*** This bug has been marked as a duplicate of bug 33815 ***