From c0b17a0df57fab140de43dbcda0877e51be2693d Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Wed, 10 Oct 2018 16:04:38 +0200 Subject: [PATCH] Bug 21311: Remove locked message from opac-auth.tt Content-Type: text/plain; charset=utf-8 We should not expose more information than needed when someone tries to login with invalid credentials. Saying that an account is locked reveals that the account exists (or perhaps an email address). Trivial fix. Keeping the var too_many_login_attempts for staff. Note: We do not remove this distinction for the staff client here (in the assumption that a library may well have additional security measures in place for staff client). But it could be done too (on another report). Test plan: Enable lockout feature. Enter invalid credentials until account locks out (on OPAC !!) Note that message does no longer change to 'Account is locked'. Signed-off-by: Marcel de Rooy --- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt index ccaddde..3153454 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -57,17 +57,8 @@ [% END %] - [% IF too_many_login_attempts %] -
- This account has been locked! - [% IF Koha.Preference('OpacResetPassword') %] - You must reset your password. - [% ELSE %] - Please contact a library staff member. - [% END %] -
- [% ELSIF invalid_username_or_password %] - + [% IF invalid_username_or_password || too_many_login_attempts %] +

You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.

-- 2.1.4