View | Details | Raw Unified | Return to bug 18314
Collapse All | Expand All

(-)a/C4/Auth.pm (-11 / +35 lines)
Lines 1206-1211 sub checkauth { Link Here
1206
        push @inputs, { name => $name, value => $value };
1206
        push @inputs, { name => $name, value => $value };
1207
    }
1207
    }
1208
1208
1209
    my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in!
1210
1209
    my $LibraryNameTitle = C4::Context->preference("LibraryName");
1211
    my $LibraryNameTitle = C4::Context->preference("LibraryName");
1210
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1212
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1211
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1213
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
Lines 1255-1260 sub checkauth { Link Here
1255
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1257
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1256
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1258
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1257
        opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
1259
        opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
1260
        too_many_login_attempts               => ( $patron and $patron->account_locked ),
1258
    );
1261
    );
1259
1262
1260
    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
1263
    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
Lines 1753-1780 sub get_session { Link Here
1753
sub checkpw {
1756
sub checkpw {
1754
    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
1757
    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
1755
    $type = 'opac' unless $type;
1758
    $type = 'opac' unless $type;
1756
    if ($ldap) {
1759
1760
    my @return;
1761
    my $patron = Koha::Patrons->find({ userid => $userid });
1762
1763
    if ( $patron and $patron->account_locked ) {
1764
        @return = (0);
1765
    } elsif ($ldap) {
1757
        $debug and print STDERR "## checkpw - checking LDAP\n";
1766
        $debug and print STDERR "## checkpw - checking LDAP\n";
1758
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1767
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1759
        return 0 if $retval == -1;                                  # Incorrect password for LDAP login attempt
1768
        if ( $retval ) {
1760
        ($retval) and return ( $retval, $retcard, $retuserid );
1769
            @return = ( $retval, $retcard, $retuserid );
1761
    }
1770
        } else {
1771
            @return = (0);
1772
        }
1762
1773
1763
    if ( $cas && $query && $query->param('ticket') ) {
1774
    } elsif ( $cas && $query && $query->param('ticket') ) {
1764
        $debug and print STDERR "## checkpw - checking CAS\n";
1775
        $debug and print STDERR "## checkpw - checking CAS\n";
1765
1776
1766
        # In case of a CAS authentication, we use the ticket instead of the password
1777
        # In case of a CAS authentication, we use the ticket instead of the password
1767
        my $ticket = $query->param('ticket');
1778
        my $ticket = $query->param('ticket');
1768
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1779
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1769
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
1780
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
1770
        ($retval) and return ( $retval, $retcard, $retuserid );
1781
        if ( $retval ) {
1771
        return 0;
1782
            @return = ( $retval, $retcard, $retuserid );
1783
        } else {
1784
            @return = (0);
1785
        }
1772
    }
1786
    }
1773
1787
1774
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1788
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1775
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1789
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1776
    # time around.
1790
    # time around.
1777
    if ( $shib && $shib_login && !$password ) {
1791
    elsif ( $shib && $shib_login && !$password ) {
1778
1792
1779
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1793
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1780
1794
Lines 1785-1797 sub checkpw { Link Here
1785
        # Then, we check if it matches a valid koha user
1799
        # Then, we check if it matches a valid koha user
1786
        if ($shib_login) {
1800
        if ($shib_login) {
1787
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1801
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1788
            ($retval) and return ( $retval, $retcard, $retuserid );
1802
            if ( $retval ) {
1789
            return 0;
1803
                @return = ( $retval, $retcard, $retuserid );
1804
            } else {
1805
                @return = (0);
1806
            }
1790
        }
1807
        }
1791
    }
1808
    }
1792
1809
1793
    # INTERNAL AUTH
1810
    # INTERNAL AUTH
1794
    return checkpw_internal( $dbh, $userid, $password, $no_set_userenv);
1811
    @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv) unless @return;
1812
1813
    if ( $return[0] == 0 ) {
1814
        $patron->update({ login_attempts => $patron->login_attempts + 1 }) if $patron;
1815
    } elsif ( $return[1] == 1 ) {
1816
        $patron->update({ login_attempts => 0 })->store if $patron;
1817
    }
1818
    return @return;
1795
}
1819
}
1796
1820
1797
sub checkpw_internal {
1821
sub checkpw_internal {
(-)a/Koha/Patron.pm (+18 lines)
Lines 584-589 sub holds { Link Here
584
    return Koha::Holds->_new_from_dbic($holds_rs);
584
    return Koha::Holds->_new_from_dbic($holds_rs);
585
}
585
}
586
586
587
=head3 account_locked
588
589
my $is_locked = $patron->account_locked
590
591
Return true if the patron has reach the maximum number of login attempts (see pref FailedLoginAttempts).
592
Otherwise return false.
593
If the pref is not set (empty string, null or 0), the feature is considered as disabled.
594
595
=cut
596
597
sub account_locked {
598
    my ($self) = @_;
599
    my $FailedLoginAttempts = C4::Context->preference('FailedLoginAttempts');
600
    return ( $FailedLoginAttempts
601
          and $self->login_attempts
602
          and $self->login_attempts >= $FailedLoginAttempts )? 1 : 0;
603
}
604
587
=head3 type
605
=head3 type
588
606
589
=cut
607
=cut
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-2 / +6 lines)
Lines 1-3 Link Here
1
[% USE Koha %]
1
[% USE Branches %]
2
[% USE Branches %]
2
[% SET footerjs = 1 %]
3
[% SET footerjs = 1 %]
3
[% INCLUDE 'doc-head-open.inc' %]
4
[% INCLUDE 'doc-head-open.inc' %]
Lines 5-11 Link Here
5
    [% IF ( nopermission ) %]Access denied[% END %]
6
    [% IF ( nopermission ) %]Access denied[% END %]
6
    [% IF ( timed_out ) %]Session timed out[% END %]
7
    [% IF ( timed_out ) %]Session timed out[% END %]
7
    [% IF ( different_ip ) %]IP address change[% END %]
8
    [% IF ( different_ip ) %]IP address change[% END %]
8
    [% IF ( invalid_username_or_password ) %]Invalid username or password[% END %]
9
    [% IF too_many_login_attempts %]This account has been locked.
10
    [% ELSIF invalid_username_or_password %]Invalid username or password[% END %]
9
    [% IF ( loginprompt ) %]Log in to Koha[% END %]
11
    [% IF ( loginprompt ) %]Log in to Koha[% END %]
10
</title>
12
</title>
11
[% INCLUDE 'doc-head-close.inc' %]
13
[% INCLUDE 'doc-head-close.inc' %]
Lines 37-43 Link Here
37
<div id="login_error"><strong>Error: </strong>Autolocation is switched on and you are logging in with an IP address that doesn't match your library. </div>
39
<div id="login_error"><strong>Error: </strong>Autolocation is switched on and you are logging in with an IP address that doesn't match your library. </div>
38
[% END %]
40
[% END %]
39
41
40
[% IF ( invalid_username_or_password ) %]
42
[% IF too_many_login_attempts %]
43
<div id="login_error"><strong>Error: </strong>This account has been locked!</div>
44
[% ELSIF invalid_username_or_password %]
41
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
45
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
42
[% END %]
46
[% END %]
43
47
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-2 / +11 lines)
Lines 53-59 Link Here
53
                                </div>
53
                                </div>
54
                            [% END %]
54
                            [% END %]
55
55
56
                            [% IF ( invalid_username_or_password ) %]
56
57
                            [% IF too_many_login_attempts %]
58
                                <div class="alert alert-info">
59
                                This account has been locked!
60
                                [% IF Koha.Preference('OpacResetPassword') %]
61
                                    <a href="/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
62
                                [% ELSE %]
63
                                    Please contact a library staff member.
64
                                [% END %]
65
                                </div>
66
                            [% ELSIF invalid_username_or_password %]
57
                                <!-- This is what is displayed if user doesnt have permission -->
67
                                <!-- This is what is displayed if user doesnt have permission -->
58
                                <div class="alert alert-info">
68
                                <div class="alert alert-info">
59
                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
69
                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
60
- 

Return to bug 18314