From c9d53f5596af470b165a7b58a9fb2aa15ee6bab3 Mon Sep 17 00:00:00 2001 From: Blou Date: Tue, 18 Jul 2017 15:56:03 -0400 Subject: [PATCH] Bug 18953 - Failure on alternate methods of login prevents validating values in DB Normally, when failing to log using LDAP (because the user doesn't exist there, for example), the system will then check the credentials directly in the database. Recent changes in the code prevent that: a failure in LDAP will prevent internal credentials to be checked. This would also happen using CAS or Shibboleth. TO reproduce, you need to enable any of the method above, then try to connect using credentials that should succeed based on the info in your borrowers DB table but fail with the given method. Then apply the patch and try again. --- C4/Auth.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index e7b0895..01573ef 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1811,7 +1811,7 @@ sub checkpw { } # INTERNAL AUTH - @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv) unless @return; + @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv) unless @return && $return[0]; if ( $return[0] == 0 ) { $patron->update({ login_attempts => $patron->login_attempts + 1 }) if $patron; -- 2.1.0