From 64fa2f40aea8bae7142584a7990e356378475016 Mon Sep 17 00:00:00 2001
From: Fridolin Somers <fridolin.somers@biblibre.com>
Date: Thu, 19 Jan 2023 15:30:19 -1000
Subject: [PATCH] Bug 25947: Improve locked account message

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a message "Patron's account has been locked (due to X failed login attempts)" on the patron details and circulation pages
  * a link to change password
  * a link to reset login attempts to 0
Links are only displayed if libarian has permission to edit patrons.

For administrative lock, only a message is displayed :
"Patron's account has been administratively locked"

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Change system preference 'FailedLoginAttempts' to a small number, like 2
2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
3. In the OPAC, try to log in with the username and a wrong password 3 times
4. Go back to the patron's account in the staff interface
5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
6. Click on "Change password", you go to change password page
7. Click on "Reset login attempts", page reloads and you see patron in unlocked

Signed-off-by: Amaury GAU <amaury.gau@bulac.fr>
---
 .../prog/en/includes/patron_messages.inc      | 20 ++++++++++++++++++-
 members/setstatus.pl                          |  3 +++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
index db9c3430fc..17534a25b7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
@@ -4,7 +4,7 @@
 [% SET return_claims = patron.return_claims %]
 [% SET logged_in_branchcode = Branches.GetLoggedInBranchcode() %]
 
-[% IF ( has_modifications || warndeparture || returnbeforeexpiry || expired || patron.gonenoaddress || patron.lost || userdebarred || odues || ( return_claims.count > ClaimReturnedWarningThreshold ) || age_limitations || charges || charges_guarantors_guarantees || charges_guarantees || credits ) %]
+[% IF ( has_modifications || warndeparture || returnbeforeexpiry || expired || patron.account_locked || patron.gonenoaddress || patron.lost || userdebarred || odues || ( return_claims.count > ClaimReturnedWarningThreshold ) || age_limitations || charges || charges_guarantors_guarantees || charges_guarantees || credits ) %]
     <h3>Attention</h3>
     <ul>
         [% IF ( has_modifications ) %]
@@ -44,6 +44,24 @@
             </li>
         [% END %]
 
+        [% IF patron.account_locked %]
+            [% IF patron.login_attempts < 0 %]
+                <li class="blocker account_admin_locked">
+                    <span class="circ-hlt">Locked: </span><span> Patron's account has been administratively locked</span>
+                </li>
+            [% ELSE %]
+                <li class="blocker account_locked">
+                <span class="circ-hlt">Locked: </span></span> Patron's account has been locked (due to [% patron.login_attempts | html %] failed login attempts)</span>
+                [% IF CAN_user_borrowers_edit_borrowers %]
+                    <span>
+                        <a href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]">Change password</a>
+                        or <a href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber | uri %]&amp;destination=circ&amp;resetloginattempts=y">Reset login attempts</a>
+                    </span>
+                [% END %]
+                </li>
+            [% END %]
+        [% END %]
+
         [% IF ( patron.gonenoaddress ) %]
             <li class="gonenoaddress blocker">
                 <span title="gonenoaddress flag is set in patron record"><span class="circ-hlt">Address:</span> Patron's address flagged as in doubt</span>
diff --git a/members/setstatus.pl b/members/setstatus.pl
index 83ef1590be..faf9bf9c78 100755
--- a/members/setstatus.pl
+++ b/members/setstatus.pl
@@ -40,6 +40,7 @@ my $destination = $input->param("destination") || '';
 my $borrowernumber=$input->param('borrowernumber');
 my $status = $input->param('status');
 my $reregistration = $input->param('reregistration') || '';
+my $resetloginattempts = $input->param('resetloginattempts') || '';
 
 my $dbh = C4::Context->dbh;
 my $dateexpiry;
@@ -54,6 +55,8 @@ if ( $logged_in_user->can_see_patron_infos($patron) ) {
     if ( $reregistration eq 'y' ) {
         # re-reregistration function to automatic calcul of date expiry
         $dateexpiry = $patron->renew_account;
+    } elsif ( $resetloginattempts eq 'y' ) {
+        $patron->login_attempts(0)->store;
     } else {
         my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
         $sth->execute( $status, $borrowernumber );
-- 
2.30.2