View | Details | Raw Unified | Return to bug 18314
Collapse All | Expand All

(-)a/C4/Auth.pm (-11 / +35 lines)
Lines 1207-1212 sub checkauth { Link Here
1207
        push @inputs, { name => $name, value => $value };
1207
        push @inputs, { name => $name, value => $value };
1208
    }
1208
    }
1209
1209
1210
    my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in!
1211
1210
    my $LibraryNameTitle = C4::Context->preference("LibraryName");
1212
    my $LibraryNameTitle = C4::Context->preference("LibraryName");
1211
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1213
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1212
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1214
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
Lines 1256-1261 sub checkauth { Link Here
1256
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1258
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1257
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1259
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1258
        opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
1260
        opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
1261
        too_many_login_attempts               => ( $patron and $patron->account_locked ),
1259
    );
1262
    );
1260
1263
1261
    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
1264
    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
Lines 1754-1781 sub get_session { Link Here
1754
sub checkpw {
1757
sub checkpw {
1755
    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
1758
    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
1756
    $type = 'opac' unless $type;
1759
    $type = 'opac' unless $type;
1757
    if ($ldap) {
1760
1761
    my @return;
1762
    my $patron = Koha::Patrons->find({ userid => $userid });
1763
1764
    if ( $patron and $patron->account_locked ) {
1765
        @return = (0);
1766
    } elsif ($ldap) {
1758
        $debug and print STDERR "## checkpw - checking LDAP\n";
1767
        $debug and print STDERR "## checkpw - checking LDAP\n";
1759
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1768
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1760
        return 0 if $retval == -1;                                  # Incorrect password for LDAP login attempt
1769
        if ( $retval ) {
1761
        ($retval) and return ( $retval, $retcard, $retuserid );
1770
            @return = ( $retval, $retcard, $retuserid );
1762
    }
1771
        } else {
1772
            @return = (0);
1773
        }
1763
1774
1764
    if ( $cas && $query && $query->param('ticket') ) {
1775
    } elsif ( $cas && $query && $query->param('ticket') ) {
1765
        $debug and print STDERR "## checkpw - checking CAS\n";
1776
        $debug and print STDERR "## checkpw - checking CAS\n";
1766
1777
1767
        # In case of a CAS authentication, we use the ticket instead of the password
1778
        # In case of a CAS authentication, we use the ticket instead of the password
1768
        my $ticket = $query->param('ticket');
1779
        my $ticket = $query->param('ticket');
1769
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1780
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1770
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
1781
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
1771
        ($retval) and return ( $retval, $retcard, $retuserid );
1782
        if ( $retval ) {
1772
        return 0;
1783
            @return = ( $retval, $retcard, $retuserid );
1784
        } else {
1785
            @return = (0);
1786
        }
1773
    }
1787
    }
1774
1788
1775
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1789
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1776
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1790
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1777
    # time around.
1791
    # time around.
1778
    if ( $shib && $shib_login && !$password ) {
1792
    elsif ( $shib && $shib_login && !$password ) {
1779
1793
1780
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1794
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1781
1795
Lines 1786-1798 sub checkpw { Link Here
1786
        # Then, we check if it matches a valid koha user
1800
        # Then, we check if it matches a valid koha user
1787
        if ($shib_login) {
1801
        if ($shib_login) {
1788
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1802
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1789
            ($retval) and return ( $retval, $retcard, $retuserid );
1803
            if ( $retval ) {
1790
            return 0;
1804
                @return = ( $retval, $retcard, $retuserid );
1805
            } else {
1806
                @return = (0);
1807
            }
1791
        }
1808
        }
1792
    }
1809
    }
1793
1810
1794
    # INTERNAL AUTH
1811
    # INTERNAL AUTH
1795
    return checkpw_internal( $dbh, $userid, $password, $no_set_userenv);
1812
    @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv) unless @return;
1813
1814
    if ( $return[0] == 0 ) {
1815
        $patron->update({ login_attempts => $patron->login_attempts + 1 }) if $patron;
1816
    } elsif ( $return[1] == 1 ) {
1817
        $patron->update({ login_attempts => 0 })->store if $patron;
1818
    }
1819
    return @return;
1796
}
1820
}
1797
1821
1798
sub checkpw_internal {
1822
sub checkpw_internal {
(-)a/Koha/Patron.pm (+18 lines)
Lines 630-635 sub get_enrollable_clubs { Link Here
630
    return wantarray ? $e->as_list : $e;
630
    return wantarray ? $e->as_list : $e;
631
}
631
}
632
632
633
=head3 account_locked
634
635
my $is_locked = $patron->account_locked
636
637
Return true if the patron has reach the maximum number of login attempts (see pref FailedLoginAttempts).
638
Otherwise return false.
639
If the pref is not set (empty string, null or 0), the feature is considered as disabled.
640
641
=cut
642
643
sub account_locked {
644
    my ($self) = @_;
645
    my $FailedLoginAttempts = C4::Context->preference('FailedLoginAttempts');
646
    return ( $FailedLoginAttempts
647
          and $self->login_attempts
648
          and $self->login_attempts >= $FailedLoginAttempts )? 1 : 0;
649
}
650
633
=head3 type
651
=head3 type
634
652
635
=cut
653
=cut
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-2 / +6 lines)
Lines 1-3 Link Here
1
[% USE Koha %]
1
[% USE Branches %]
2
[% USE Branches %]
2
[% SET footerjs = 1 %]
3
[% SET footerjs = 1 %]
3
[% INCLUDE 'doc-head-open.inc' %]
4
[% INCLUDE 'doc-head-open.inc' %]
Lines 5-11 Link Here
5
    [% IF ( nopermission ) %]Access denied[% END %]
6
    [% IF ( nopermission ) %]Access denied[% END %]
6
    [% IF ( timed_out ) %]Session timed out[% END %]
7
    [% IF ( timed_out ) %]Session timed out[% END %]
7
    [% IF ( different_ip ) %]IP address change[% END %]
8
    [% IF ( different_ip ) %]IP address change[% END %]
8
    [% IF ( invalid_username_or_password ) %]Invalid username or password[% END %]
9
    [% IF too_many_login_attempts %]This account has been locked.
10
    [% ELSIF invalid_username_or_password %]Invalid username or password[% END %]
9
    [% IF ( loginprompt ) %]Log in to Koha[% END %]
11
    [% IF ( loginprompt ) %]Log in to Koha[% END %]
10
</title>
12
</title>
11
[% INCLUDE 'doc-head-close.inc' %]
13
[% INCLUDE 'doc-head-close.inc' %]
Lines 37-43 Link Here
37
<div id="login_error"><strong>Error: </strong>Autolocation is switched on and you are logging in with an IP address that doesn't match your library. </div>
39
<div id="login_error"><strong>Error: </strong>Autolocation is switched on and you are logging in with an IP address that doesn't match your library. </div>
38
[% END %]
40
[% END %]
39
41
40
[% IF ( invalid_username_or_password ) %]
42
[% IF too_many_login_attempts %]
43
<div id="login_error"><strong>Error: </strong>This account has been locked!</div>
44
[% ELSIF invalid_username_or_password %]
41
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
45
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
42
[% END %]
46
[% END %]
43
47
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-2 / +11 lines)
Lines 53-59 Link Here
53
                                </div>
53
                                </div>
54
                            [% END %]
54
                            [% END %]
55
55
56
                            [% IF ( invalid_username_or_password ) %]
56
57
                            [% IF too_many_login_attempts %]
58
                                <div class="alert alert-info">
59
                                This account has been locked!
60
                                [% IF Koha.Preference('OpacResetPassword') %]
61
                                    <a href="/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
62
                                [% ELSE %]
63
                                    Please contact a library staff member.
64
                                [% END %]
65
                                </div>
66
                            [% ELSIF invalid_username_or_password %]
57
                                <!-- This is what is displayed if user doesnt have permission -->
67
                                <!-- This is what is displayed if user doesnt have permission -->
58
                                <div class="alert alert-info">
68
                                <div class="alert alert-info">
59
                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
69
                                    <p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
60
- 

Return to bug 18314