Bugzilla – Attachment 167795 Details for
Bug 37104
Block AnonymousPatron from logging into anything
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC
Bug-37104-Block-AnonymousPatron-from-logging-into-.patch (text/plain), 4.28 KB, created by
Sam Lau
on 2024-06-17 17:05:12 UTC
(
hide
)
Description:
Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC
Filename:
MIME Type:
Creator:
Sam Lau
Created:
2024-06-17 17:05:12 UTC
Size:
4.28 KB
patch
obsolete
>From 3f652c976762598de029cfd383047a2de6ea4da0 Mon Sep 17 00:00:00 2001 >From: Sam Lau <samalau@gmail.com> >Date: Mon, 17 Jun 2024 16:26:40 +0000 >Subject: [PATCH] Bug 37104: Block AnonymousPatron from logging into staff > interface and OPAC > >This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. > >To test: >1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. >2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") >3) Ensure that you know the username and password for this patron and can log in. >4) Visit the OPAC, attempt to log-in with your anon patron. >5) Note that you can log in and nothing happens. >6) Visit the staff interface, attempt to log-in with anon patron. >7) Once again, note that you are able to log-in with no issue. >8) Apply patch and restart_all >9) Attempt to log into the OPAC and staff interface with the patron again. >10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" >--- > C4/Auth.pm | 7 +++++++ > koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 2 ++ > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 6 ++++++ > 3 files changed, 15 insertions(+) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 6e75267c7c..c87bc511a0 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1451,6 +1451,8 @@ sub checkauth { > opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'}, > too_many_login_attempts => ( $patron and $patron->account_locked ), > password_has_expired => ( $patron and $patron->password_expired ), >+ borrowernumber => ( $patron and $patron->borrowernumber ), >+ anonymous_patron => C4::Context->preference('AnonymousPatron'), > auth_error => $auth_error, > ); > >@@ -1977,6 +1979,8 @@ sub checkpw { > my $shib = C4::Context->config('useshibboleth') && shib_ok(); > my $shib_login = $shib ? get_login_shib() : undef; > >+ my $anonymous_patron = C4::Context->preference('AnonymousPatron'); >+ > my @return; > my $patron; > if ( defined $userid ) { >@@ -2053,6 +2057,9 @@ sub checkpw { > if ( $patron->password_expired ) { > @return = ( -2, $patron ); > } >+ if ( $patron->borrowernumber eq $anonymous_patron ) { >+ @return = ( -1, $patron ); >+ } > } elsif ( !$patron->account_locked ) { > $patron->update( { login_attempts => $patron->login_attempts + 1 } ); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index 4d24895225..a0e5ec10a2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -85,6 +85,8 @@ > [% END %] > [% ELSIF invalid_username_or_password %] > <div id="login_error"><strong>Error: </strong>Invalid username or password</div> >+[% ELSIF borrowernumber == anonymous_patron %] >+ <div id="login_error"><strong>Error: </strong>You can't log in as the anonymous patron!</div> > [% END %] > > [% IF auth_error %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 52a59027c9..a9cb1cc921 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -188,6 +188,12 @@ > [% END # /IF GoogleOpenIDConnect %] > [% END # /UNLESS OPACShibOnly %] > >+ [% IF !(invalid_username_or_password || too_many_login_attempts) and (borrowernumber == anonymous_patron) %] >+ <div class="alert alert-info"> >+ <p><strong>Error: </strong>You can't log in as the anonymous patron!</p> >+ </div> >+ [% END %] >+ > [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %] > <div class="alert alert-info"> > <p><strong>Error: </strong>Your password has expired!</p> >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37104
:
167793
|
167795
|
167798
|
167801
|
167802
|
167811
|
167812
|
167813
|
168268
|
168269
|
168270
|
168592
|
168666
|
168694