From 586d45e439360c14f70f887143000640800c17e5 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 13 Dec 2018 14:56:22 -0500
Subject: [PATCH] Bug 21997 - SIP patron information requests can lock patron
out of account
Many SIP services send an empty password field (AD). Even if allow_empty_passwords is enabled for the given SIP account, this empty password is run though Koha's password checker which increments the number of login attempts for a patron. Thus repeated patron information requests can lock a patron out! Empty password fields in SIP should not call for a password check if allow_empty_passwords is enabled.
Test Plan:
1) Enable a patron password attempt with a limit of 3
2) Send 4 patron information requests with an empty AD field
3) Note the patron's account is now locked
4) Apply this patch
5) Repeat step 2 with a different patron
6) Note the patron's account does not get locked!
Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
---
C4/SIP/Sip/MsgType.pm | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/C4/SIP/Sip/MsgType.pm b/C4/SIP/Sip/MsgType.pm
index 9ec126e..43b02d2 100644
--- a/C4/SIP/Sip/MsgType.pm
+++ b/C4/SIP/Sip/MsgType.pm
@@ -965,9 +965,10 @@ sub handle_patron_info {
if ( defined($patron_pwd) ) {
# If patron password was provided, report whether it was right or not.
- $password_rc = $patron->check_password($patron_pwd);
if ( $patron_pwd eq q{} && $server->{account}->{allow_empty_passwords} ) {
$password_rc = 1;
+ } else {
+ $password_rc = $patron->check_password($patron_pwd);
}
$resp .= add_field( FID_VALID_PATRON_PWD, sipbool( $password_rc ) );
}
--
2.7.4