Attachment 80623 Details for Bug 21311 – Bug 21311: Remove locked message from opac-auth.tt

[patch] Bug 21311: Remove locked message from opac-auth.tt

Bug-21311-Remove-locked-message-from-opac-authtt.patch (text/plain), 2.94 KB, created by Mark Tompsett on 2018-10-15 16:55:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Tompsett

Created: 2018-10-15 16:55:28 UTC

Size: 2.94 KB

patch

obsolete

>From c03e839a7cd27dde9a06abd40e251c3f548648c4 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Wed, 10 Oct 2018 16:04:38 +0200
>Subject: [PATCH] Bug 21311: Remove locked message from opac-auth.tt
>
>We should not expose more information than needed when someone tries
>to login with invalid credentials. Saying that an account is locked
>reveals that the account exists (or perhaps an email address).
>
>Trivial fix. Keeping the var too_many_login_attempts for staff.
>Note: We do not remove this distinction for the staff client here (in the
>assumption that a library may well have additional security measures in
>place for staff client). But it could be done too (on another report).
>
>Test plan:
>Enable lockout feature.
>Enter invalid credentials until account locks out (on OPAC !!)
>Note that message does no longer change to 'Account is locked'.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>
>Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
>---
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 15 +++------------
> 1 file changed, 3 insertions(+), 12 deletions(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
>index ccaddde454..b45c06f0cf 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
>@@ -57,19 +57,10 @@
>                             [% END %]
> 
> 
>-                            [% IF too_many_login_attempts %]
>+                            [% IF invalid_username_or_password || too_many_login_attempts %]
>+                                
>                                 <div class="alert alert-info">
>-                                This account has been locked!
>-                                [% IF Koha.Preference('OpacResetPassword') %]
>-                                    <a href="/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
>-                                [% ELSE %]
>-                                    Please contact a library staff member.
>-                                [% END %]
>-                                </div>
>-                            [% ELSIF invalid_username_or_password %]
>-                                
>-                                <div class="alert alert-info">
>-                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
>+                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive. Please contact a library staff member if you continue to have problems.</p>
>                                 </div>
>                             [% END %]
> 
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 21311: 80352 | 80388 | 80623 | 81123 | 81124 | 81125 | 81403