From 6c33f9177da5f251a9f3995e41135c9508903b24 Mon Sep 17 00:00:00 2001
From: Sam Lau <samalau@gmail.com>
Date: Mon, 17 Jun 2024 16:26:40 +0000
Subject: [PATCH] Bug 37104: Block AnonymousPatron from logging into staff
 interface and OPAC

This patch blocks the patron set as the anonymous patron from logging into the staff interface and OPAC.

To test:
1) In Administration->sys. pref, make sure AnonymousPatron is pointed to an account.
2) Visit that patron's page and set their permissions to superlibrarian ("Access to all librarian functions")
3) Ensure that you know the username and password for this patron and can log in.
4) Visit the OPAC, attempt to log-in with your anon patron.
5) Note that you can log in and nothing happens.
6) Visit the staff interface, attempt to log-in with anon patron.
7) Once again, note that you are able to log-in with no issue.
8) Apply patch and restart_all
9) Attempt to log into the OPAC and staff interface with the patron again.
10) This time, you should get an error message on both pages saying, "Error: You can't log in as the anonymous patron!"
---
 C4/Auth.pm                                            | 11 +++++++++++
 koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt       |  2 ++
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt |  6 ++++++
 3 files changed, 19 insertions(+)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 6e75267c7c..ab6827f615 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1417,6 +1417,11 @@ sub checkauth {
     my $auth_error = $query->param('auth_error');
     my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
     my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
+
+    my $borrowernumber = $patron and $patron->borrowernumber;
+    my $anonymous_patron = C4::Context->preference('AnonymousPatron');
+    my $is_anonymous_patron = $patron && ( $patron->borrowernumber eq $anonymous_patron );
+
     $template->param(
         login                                 => 1,
         INPUTS                                => \@inputs,
@@ -1451,6 +1456,7 @@ sub checkauth {
         opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
         too_many_login_attempts               => ( $patron and $patron->account_locked ),
         password_has_expired                  => ( $patron and $patron->password_expired ),
+        is_anonymous_patron                   => ( $is_anonymous_patron ),
         auth_error                            => $auth_error,
     );
 
@@ -1977,6 +1983,8 @@ sub checkpw {
     my $shib       = C4::Context->config('useshibboleth') && shib_ok();
     my $shib_login = $shib ? get_login_shib() : undef;
 
+    my $anonymous_patron = C4::Context->preference('AnonymousPatron');
+
     my @return;
     my $patron;
     if ( defined $userid ) {
@@ -2053,6 +2061,9 @@ sub checkpw {
             if ( $patron->password_expired ) {
                 @return = ( -2, $patron );
             }
+            if ( $patron->borrowernumber eq $anonymous_patron ) {
+                @return = ( -2, $patron );
+            }
         } elsif ( !$patron->account_locked ) {
             $patron->update( { login_attempts => $patron->login_attempts + 1 } );
         }
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
index 4d24895225..a56afcf3ca 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
@@ -85,6 +85,8 @@
     [% END %]
 [% ELSIF invalid_username_or_password %]
 <div id="login_error"><strong>Error: </strong>Invalid username or password</div>
+[% ELSIF is_anonymous_patron %]
+    <div id="login_error"><strong>Error: </strong>You can't log in as the anonymous patron!</div>
 [% END %]
 
 [% IF auth_error %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
index 52a59027c9..265fb1a6d3 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
@@ -188,6 +188,12 @@
                             [% END # /IF GoogleOpenIDConnect %]
                         [% END # /UNLESS OPACShibOnly %]
 
+                        [% IF !(invalid_username_or_password || too_many_login_attempts) and is_anonymous_patron %]
+                            <div class="alert alert-info">
+                                <p><strong>Error: </strong>You can't log in as the anonymous patron!</p>
+                            </div>
+                        [% END %]
+
                         [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %]
                             <div class="alert alert-info">
                                 <p><strong>Error: </strong>Your password has expired!</p>
-- 
2.39.2