Bug 36679 - Anonymous patron is not blocked from checkout via self check
Summary: Anonymous patron is not blocked from checkout via self check
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Lucas Gass
QA Contact: Martin Renvoize
URL:
Keywords:
Depends on:
Blocks: 37104
  Show dependency treegraph
 
Reported: 2024-04-23 20:29 UTC by Christopher Brannon
Modified: 2024-07-25 11:11 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes the web-based self-checkout system to prevent the AnonymousPatron from checking out items.
Version(s) released in:
24.11.00,24.05.02,23.11.07
Circulation function:


Attachments
Bug 36679: Prevent SCO login for the AnonymousPatron (1.89 KB, patch)
2024-04-24 20:07 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 36679: Prevent SCO login for the AnonymousPatron (1.94 KB, patch)
2024-05-01 21:33 UTC, David Nind
Details | Diff | Splinter Review
Bug 36679: Prevent SCO login for the AnonymousPatron (1.96 KB, patch)
2024-06-04 12:15 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2024-04-23 20:29:34 UTC
The anonymous patron is not allowed to checkout through the staff module, but it appears that you can login as this user on the self check and check out items.

While it is more likely this could be exploited with a random library card number, this does create a hole in blocking circ on this account.
Comment 1 Christopher Brannon 2024-04-24 18:58:49 UTC
This also seems to be the case with SIP transactions.

I've restricted the anonymous account.
Comment 2 Christopher Brannon 2024-04-24 19:01:20 UTC
1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!

I would HIGHLY suggest preventing the account from using anonymous as the cardnumber/username.

Koha should also block this patron from checking out, just like it does in the staff interface.  Maybe it should just be automatically restricted account indefinitely?
Comment 3 Lucas Gass 2024-04-24 20:07:12 UTC
Created attachment 165487 [details] [review]
Bug 36679: Prevent SCO login for the AnonymousPatron

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.
Comment 4 Lucas Gass 2024-04-24 20:08:35 UTC
(In reply to Christopher Brannon from comment #1)
> This also seems to be the case with SIP transactions.
> 
> I've restricted the anonymous account.

Christopher,

Can you file a separate bug outlining how you were able to do this via a SIP transaction? 

Thanks!
Comment 5 Lucas Gass 2024-04-24 20:19:21 UTC
This blocks the AnonymousPatron from logging in at the SCO module. Is there any reason that the AnonymousPatron should be able to log into anything? ( OPAC/SCO/Staff )

Maybe we should block this at Auth.pm?
Comment 6 Christopher Brannon 2024-04-24 22:28:03 UTC
(In reply to Lucas Gass from comment #4)
> (In reply to Christopher Brannon from comment #1)
> > This also seems to be the case with SIP transactions.
> > 
> > I've restricted the anonymous account.
> 
> Christopher,
> 
> Can you file a separate bug outlining how you were able to do this via a SIP
> transaction? 
> 
> Thanks!

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36695
Comment 7 David Nind 2024-05-01 21:33:14 UTC
Created attachment 166025 [details] [review]
Bug 36679: Prevent SCO login for the AnonymousPatron

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.

Signed-off-by: David Nind <david@davidnind.com>
Comment 8 David Nind 2024-05-01 21:35:00 UTC
Testing notes using KTD:

1. Step 5: [hostname]/cgi-bin/koha/sco/sco-main.pl

2. Step 8: While the URL is /cgi-bin/koha/opac-main.pl, the page has the log in form in the middle and none of the normal header (including the OPAC search box).
Comment 9 Martin Renvoize 2024-06-04 12:15:29 UTC
Created attachment 167392 [details] [review]
Bug 36679: Prevent SCO login for the AnonymousPatron

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2024-06-04 12:15:55 UTC
Nice simple fix, passing QA
Comment 11 Martin Renvoize 2024-06-10 15:27:25 UTC
Thanks for all the hard work!

Pushed to main for the next 24.11.00 release as RM Assistant
Comment 12 Lucas Gass 2024-06-27 22:02:36 UTC
Backported to 24.05.x for upcoming 24.05.02
Comment 13 Fridolin Somers 2024-07-17 13:39:50 UTC
Cool.
We should consider creating Koha::Patron->is_anonymous()
Comment 14 Fridolin Somers 2024-07-17 13:41:40 UTC
Pushed to 23.11.x for 23.11.07
Comment 15 wainuiwitikapark 2024-07-19 03:23:22 UTC
not backporting to 23.05.x unless requested