From 5312d17f747625517c2fcea77be327d4ec46f155 Mon Sep 17 00:00:00 2001
From: Nick <nick@bywatersolutions.com>
Date: Mon, 7 Oct 2019 20:09:04 +0000
Subject: [PATCH] Bug 23771: Don't look for patrons if we don't have a userid

While the code requires external auth to test, the change is simple enough I
think a good read would suffice

To test:
1 - You either need Shib or CAS enabled and setup
2 - Add two users with blank.null cardnumbers
3 - Lock those user accounts
    Set failedloginattempts to 1
    Try a bad login with the userid
    Or set via the DB
4 - Try a good login via the external auth
5 - Note it fails
6 - Apply patch
7 - Login now succeeds

Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu>
---
 C4/Auth.pm | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 725ab74191..cd53ecd3c6 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1781,8 +1781,11 @@ sub checkpw {
     my $shib_login = $shib ? get_login_shib() : undef;
 
     my @return;
-    my $patron = Koha::Patrons->find({ userid => $userid });
-    $patron = Koha::Patrons->find({ cardnumber => $userid }) unless $patron;
+    my $patron;
+    if ( defined $userid ){
+        $patron = Koha::Patrons->find({ userid => $userid });
+        $patron = Koha::Patrons->find({ cardnumber => $userid }) unless $patron;
+    }
     my $check_internal_as_fallback = 0;
     my $passwd_ok = 0;
     # Note: checkpw_* routines returns:
-- 
2.11.0