From afcb309b5c53accb7e19b43be58f26f830a2c1ad Mon Sep 17 00:00:00 2001
From: Nick <nick@bywatersolutions.com>
Date: Mon, 7 Oct 2019 20:09:04 +0000
Subject: [PATCH] Bug 23771: Don't look for patrons if we don't have a userid

While the code requires external auth to test, the change is simple enough I
think a good read would suffice

To test:
1 - You either need Shib or CAS enabled and setup
2 - Add two users with blank.null cardnumbers
3 - Lock those user accounts
    Set failedloginattempts to 1
    Try a bad login with the userid
    Or set via the DB
4 - Try a good login via the external auth
5 - Note it fails
6 - Apply patch
7 - Login now succeeds
---
 C4/Auth.pm | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 24296c5996..913aaa2ea2 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1781,8 +1781,11 @@ sub checkpw {
     my $shib_login = $shib ? get_login_shib() : undef;
 
     my @return;
-    my $patron = Koha::Patrons->find({ userid => $userid });
-    $patron = Koha::Patrons->find({ cardnumber => $userid }) unless $patron;
+    my $patron;
+    if ( defined $userid ){
+        $patron = Koha::Patrons->find({ userid => $userid });
+        $patron = Koha::Patrons->find({ cardnumber => $userid }) unless $patron;
+    }
     my $check_internal_as_fallback = 0;
     my $passwd_ok = 0;
     # Note: checkpw_* routines returns:
-- 
2.11.0