From 3f652c976762598de029cfd383047a2de6ea4da0 Mon Sep 17 00:00:00 2001 From: Sam Lau Date: Mon, 17 Jun 2024 16:26:40 +0000 Subject: [PATCH] Bug 37104: Block AnonymousPatron from logging into staff interface and OPAC This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC. To test: 1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account. 2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions") 3) Ensure that you know the username and password for this patron and can log in. 4) Visit the OPAC, attempt to log-in with your anon patron. 5) Note that you can log in and nothing happens. 6) Visit the staff interface, attempt to log-in with anon patron. 7) Once again, note that you are able to log-in with no issue. 8) Apply patch and restart_all 9) Attempt to log into the OPAC and staff interface with the patron again. 10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!" --- C4/Auth.pm | 7 +++++++ koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 2 ++ koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 6 ++++++ 3 files changed, 15 insertions(+) diff --git a/C4/Auth.pm b/C4/Auth.pm index 6e75267c7c..c87bc511a0 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1451,6 +1451,8 @@ sub checkauth { opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'}, too_many_login_attempts => ( $patron and $patron->account_locked ), password_has_expired => ( $patron and $patron->password_expired ), + borrowernumber => ( $patron and $patron->borrowernumber ), + anonymous_patron => C4::Context->preference('AnonymousPatron'), auth_error => $auth_error, ); @@ -1977,6 +1979,8 @@ sub checkpw { my $shib = C4::Context->config('useshibboleth') && shib_ok(); my $shib_login = $shib ? get_login_shib() : undef; + my $anonymous_patron = C4::Context->preference('AnonymousPatron'); + my @return; my $patron; if ( defined $userid ) { @@ -2053,6 +2057,9 @@ sub checkpw { if ( $patron->password_expired ) { @return = ( -2, $patron ); } + if ( $patron->borrowernumber eq $anonymous_patron ) { + @return = ( -1, $patron ); + } } elsif ( !$patron->account_locked ) { $patron->update( { login_attempts => $patron->login_attempts + 1 } ); } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt index 4d24895225..a0e5ec10a2 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt @@ -85,6 +85,8 @@ [% END %] [% ELSIF invalid_username_or_password %]
Error: Invalid username or password
+[% ELSIF borrowernumber == anonymous_patron %] +
Error: You can't log in as the anonymous patron!
[% END %] [% IF auth_error %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt index 52a59027c9..a9cb1cc921 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -188,6 +188,12 @@ [% END # /IF GoogleOpenIDConnect %] [% END # /UNLESS OPACShibOnly %] + [% IF !(invalid_username_or_password || too_many_login_attempts) and (borrowernumber == anonymous_patron) %] +
+

Error: You can't log in as the anonymous patron!

+
+ [% END %] + [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %]

Error: Your password has expired!

-- 2.39.2