From aef69e286a9d399e0334afca99c2180f7a6e3043 Mon Sep 17 00:00:00 2001 From: Lucas Gass Date: Wed, 24 Apr 2024 20:00:53 +0000 Subject: [PATCH] Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'. --- opac/sco/sco-main.pl | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index a7fcb24d8f..6262af7b50 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -123,11 +123,18 @@ unless ( $patronid ) { } my $patron; +my $anonymous_patron = C4::Context->preference('AnonymousPatron'); if ( $patronid ) { Koha::Plugins->call( 'patron_barcode_transform', \$patronid ); $patron = Koha::Patrons->find( { cardnumber => $patronid } ); + # redirect to OPAC home if user is trying to log in as the anonymous patron + if ( $patron && ( $patron->borrowernumber eq $anonymous_patron ) ) { + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; + } } + undef $jwt unless $patron; my $branch = $issuer->{branchcode}; -- 2.30.2