View | Details | Raw Unified | Return to bug 18314
Collapse All | Expand All

(-)a/C4/Auth.pm (-11 / +35 lines)
Lines 1181-1186 sub checkauth { Link Here
1181
        push @inputs, { name => $name, value => $value };
1181
        push @inputs, { name => $name, value => $value };
1182
    }
1182
    }
1183
1183
1184
    my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in!
1185
1184
    my $LibraryNameTitle = C4::Context->preference("LibraryName");
1186
    my $LibraryNameTitle = C4::Context->preference("LibraryName");
1185
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1187
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1186
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1188
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
Lines 1230-1235 sub checkauth { Link Here
1230
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1232
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1231
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1233
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1232
        opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
1234
        opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
1235
        too_many_login_attempts               => ( $patron and $patron->account_locked ),
1233
    );
1236
    );
1234
1237
1235
    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
1238
    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
Lines 1728-1755 sub get_session { Link Here
1728
sub checkpw {
1731
sub checkpw {
1729
    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
1732
    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
1730
    $type = 'opac' unless $type;
1733
    $type = 'opac' unless $type;
1731
    if ($ldap) {
1734
1735
    my @return;
1736
    my $patron = Koha::Patrons->find({ userid => $userid });
1737
1738
    if ( $patron and $patron->account_locked ) {
1739
        @return = (0);
1740
    } elsif ($ldap) {
1732
        $debug and print STDERR "## checkpw - checking LDAP\n";
1741
        $debug and print STDERR "## checkpw - checking LDAP\n";
1733
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1742
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1734
        return 0 if $retval == -1;                                  # Incorrect password for LDAP login attempt
1743
        if ( $retval ) {
1735
        ($retval) and return ( $retval, $retcard, $retuserid );
1744
            @return = ( $retval, $retcard, $retuserid );
1736
    }
1745
        } else {
1746
            @return = (0);
1747
        }
1737
1748
1738
    if ( $cas && $query && $query->param('ticket') ) {
1749
    } elsif ( $cas && $query && $query->param('ticket') ) {
1739
        $debug and print STDERR "## checkpw - checking CAS\n";
1750
        $debug and print STDERR "## checkpw - checking CAS\n";
1740
1751
1741
        # In case of a CAS authentication, we use the ticket instead of the password
1752
        # In case of a CAS authentication, we use the ticket instead of the password
1742
        my $ticket = $query->param('ticket');
1753
        my $ticket = $query->param('ticket');
1743
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1754
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1744
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
1755
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
1745
        ($retval) and return ( $retval, $retcard, $retuserid );
1756
        if ( $retval ) {
1746
        return 0;
1757
            @return = ( $retval, $retcard, $retuserid );
1758
        } else {
1759
            @return = (0);
1760
        }
1747
    }
1761
    }
1748
1762
1749
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1763
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1750
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1764
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1751
    # time around.
1765
    # time around.
1752
    if ( $shib && $shib_login && !$password ) {
1766
    elsif ( $shib && $shib_login && !$password ) {
1753
1767
1754
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1768
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1755
1769
Lines 1760-1772 sub checkpw { Link Here
1760
        # Then, we check if it matches a valid koha user
1774
        # Then, we check if it matches a valid koha user
1761
        if ($shib_login) {
1775
        if ($shib_login) {
1762
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1776
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1763
            ($retval) and return ( $retval, $retcard, $retuserid );
1777
            if ( $retval ) {
1764
            return 0;
1778
                @return = ( $retval, $retcard, $retuserid );
1779
            } else {
1780
                @return = (0);
1781
            }
1765
        }
1782
        }
1766
    }
1783
    }
1767
1784
1768
    # INTERNAL AUTH
1785
    # INTERNAL AUTH
1769
    return checkpw_internal( $dbh, $userid, $password, $no_set_userenv);
1786
    @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv) unless @return;
1787
1788
    if ( $return[0] == 0 ) {
1789
        $patron->update({ login_attempts => $patron->login_attempts + 1 }) if $patron;
1790
    } elsif ( $return[1] == 1 ) {
1791
        $patron->update({ login_attempts => 0 })->store if $patron;
1792
    }
1793
    return @return;
1770
}
1794
}
1771
1795
1772
sub checkpw_internal {
1796
sub checkpw_internal {
(-)a/Koha/Patron.pm (+18 lines)
Lines 584-589 sub holds { Link Here
584
    return Koha::Holds->_new_from_dbic($holds_rs);
584
    return Koha::Holds->_new_from_dbic($holds_rs);
585
}
585
}
586
586
587
=head3 account_locked
588
589
my $is_locked = $patron->account_locked
590
591
Return true if the patron has reach the maximum number of login attempts (see pref FailedLoginAttempts).
592
Otherwise return false.
593
If the pref is not set (empty string, null or 0), the feature is considered as disabled.
594
595
=cut
596
597
sub account_locked {
598
    my ($self) = @_;
599
    my $FailedLoginAttempts = C4::Context->preference('FailedLoginAttempts');
600
    return ( $FailedLoginAttempts
601
          and $self->login_attempts
602
          and $self->login_attempts >= $FailedLoginAttempts )? 1 : 0;
603
}
604
587
=head3 type
605
=head3 type
588
606
589
=cut
607
=cut
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-2 / +6 lines)
Lines 1-3 Link Here
1
[% USE Koha %]
1
[% USE Branches %]
2
[% USE Branches %]
2
[% SET footerjs = 1 %]
3
[% SET footerjs = 1 %]
3
[% INCLUDE 'doc-head-open.inc' %]
4
[% INCLUDE 'doc-head-open.inc' %]
Lines 5-11 Link Here
5
    [% IF ( nopermission ) %]Access denied[% END %]
6
    [% IF ( nopermission ) %]Access denied[% END %]
6
    [% IF ( timed_out ) %]Session timed out[% END %]
7
    [% IF ( timed_out ) %]Session timed out[% END %]
7
    [% IF ( different_ip ) %]IP address change[% END %]
8
    [% IF ( different_ip ) %]IP address change[% END %]
8
    [% IF ( invalid_username_or_password ) %]Invalid username or password[% END %]
9
    [% IF too_many_login_attempts %]This account has been locked.
10
    [% ELSIF invalid_username_or_password %]Invalid username or password[% END %]
9
    [% IF ( loginprompt ) %]Log in to Koha[% END %]
11
    [% IF ( loginprompt ) %]Log in to Koha[% END %]
10
</title>
12
</title>
11
[% INCLUDE 'doc-head-close.inc' %]
13
[% INCLUDE 'doc-head-close.inc' %]
Lines 37-43 Link Here
37
<div id="login_error"><strong>Error: </strong>Autolocation is switched on and you are logging in with an IP address that doesn't match your library. </div>
39
<div id="login_error"><strong>Error: </strong>Autolocation is switched on and you are logging in with an IP address that doesn't match your library. </div>
38
[% END %]
40
[% END %]
39
41
40
[% IF ( invalid_username_or_password ) %]
42
[% IF too_many_login_attempts %]
43
<div id="login_error"><strong>Error: </strong>This account has been locked!</div>
44
[% ELSIF invalid_username_or_password %]
41
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
45
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
42
[% END %]
46
[% END %]
43
47
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-2 / +11 lines)
Lines 53-59 Link Here
53
                                </div>
53
                                </div>
54
                            [% END %]
54
                            [% END %]
55
55
56
                            [% IF ( invalid_username_or_password ) %]
56
57
                            [% IF too_many_login_attempts %]
58
                                <div class="alert alert-info">
59
                                This account has been locked!
60
                                [% IF Koha.Preference('OpacResetPassword') %]
61
                                    <a href="/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
62
                                [% ELSE %]
63
                                    Please contact a library staff member.
64
                                [% END %]
65
                                </div>
66
                            [% ELSIF invalid_username_or_password %]
57
                                <!-- This is what is displayed if user doesnt have permission -->
67
                                <!-- This is what is displayed if user doesnt have permission -->
58
                                <div class="alert alert-info">
68
                                <div class="alert alert-info">
59
                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
69
                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
60
- 

Return to bug 18314