Summary: | Staff users without superlibrarian can't log into OPAC | ||
---|---|---|---|
Product: | Koha | Reporter: | Katrin Fischer <katrin.fischer> |
Component: | Authentication | Assignee: | Bugs List <koha-bugs> |
Status: | In Discussion --- | QA Contact: | Testopia <testopia> |
Severity: | minor | ||
Priority: | P5 - low | CC: | dcook, dpavlin, fridolin.somers, jonathan.druart, oleonard, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 15492 | ||
Bug Blocks: | |||
Attachments: | Bug 20632: Alert when SCO or SCI user in OPAC login page |
Description
Katrin Fischer
2018-04-22 09:01:50 UTC
It's not a bug actually, but we need to do something to avoid this configuration issue: the new permissions self_check must not be set for normal users, we may need to add a warning on the permission page. Ok, I think adding a note to Self check modules permission could help here for now. At least then, staring on permissions will give you a hint :) Maybe: Set only for self-check users, prevents OPAC login. OK? There is a note already: " self_checkin_module Log into the self check-in module. Note: this permission prevents the patron from using any other OPAC functionality " https://screenshots.firefox.com/578CGKmzkgVDIjEa/pro.kohadev.org You are right, I missed it because i was looking at the top level permission with the others collapsed. Maybe we should add a warning/message on the patron's defail page? (In reply to Jonathan Druart from comment #6) > Maybe we should add a warning/message on the patron's defail page? I agree. We could add something noticeable that tells the patron situation. I'm not sure where to put it. Adding Owen to the conversation. Sorry Owen! I spend 1 hour searching for this. I reopen to add a warning message. Created attachment 145991 [details] [review] Bug 20632: Alert when SCO or SCI user in OPAC login page Special patrons for self check-out/check-in are not allowed to login into OPAC. This patch adds an alter message in OPAC login page when authentification is tried with SCO/SCI user. Test plan : 1) SCO 1.1) Use koha-testing-docker that is configured with patron 'self_checkout' 1.2) Go to OPAC main page, not logged-in 1.3) Try to login with login 'self_checkout' and password 'self_checkout' => You see an alert 'You can not loggin with self check-out user' 2) SCI 2.1) Create a new patron with login 'self_checkin', password 'self_checkin' 2.2) Define on him the permission 'self_checkin_module' 2.3) Go to OPAC main page, not logged-in 2.4) Try to login with login 'self_checkin' and password 'self_checkin' => You see an alert 'You can not loggin with self check-in user' I don't think this is valid, that could be considered a security issue to provide such info. C4::Auth changes without tests => FQA anyway. In this case a less specific message ? Like "Login failed because of technical issue" |