From e999b3aa156816613391d3354c652777679b2e97 Mon Sep 17 00:00:00 2001 From: Emmi Takkinen Date: Tue, 15 Apr 2025 11:11:09 +0300 Subject: [PATCH 2/2] Bug 22322: Don't log login failure to action_logs when page is refreshed If sysprefs AuthFailureLog and SelfCheckoutByLogin are enabled and one logs in to the SCO from OPAC or refreshes the SCOs login page, this is added to the action_logs table as an authentication failure. We shouldn't log when this happens since these are not real login attempts. To test: 1. Make sure you have AuthFailureLog enabled. 2. Check how many rows are returned from database with following query: SELECT count(*) FROM action_logs WHERE module = "AUTH" and action = "FAILURE"; 3. Enable syspref SelfCheckoutByLogin. 4. Navigate to SCO page and login to OPAC when asked. 5. After SCO login page is displayed, check database again. => Result has now increased by 1. 6. Refresh page. => Result has again increased by 1. 7. Apply this patch, restart services if needed. 8. Login to SCO again from OPAC again or just refresh the page. 9. Check database. => Confirm that result hasn't increased. 10. Refresh page and check database. => Confirm that result hasn't increased. 11. Confirm that login to SCO still works as it should. Sponsored-by: Koha-Suomi Oy --- opac/sco/sco-main.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index d21dc44da2..5225220b71 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -114,7 +114,7 @@ my $issuer = Koha::Patrons->find($issuerid)->unblessed; my $patronid = $jwt ? Koha::Token->new->decode_jwt( { token => $jwt } ) : undef; unless ($patronid) { - if ( C4::Context->preference('SelfCheckoutByLogin') ) { + if ( C4::Context->preference('SelfCheckoutByLogin') && $op eq "cud-login" ) { ( undef, $patronid ) = checkpw( $patronlogin, $patronpw ); } else { # People should not do that unless they know what they are doing! # SelfCheckAllowByIPRanges MUST be configured -- 2.34.1