| Summary: | Logging in via cardnumber circumvents account logout | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
| Component: | Authentication | Assignee: | Nick Clemens (kidclamp) <nick> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | dpavlin, fridolin.somers, jonathan.druart, martin.renvoize, nick |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
19.05.00, 18.11.05, 18.05.12
|
|
| Circulation function: | |||
| Attachments: |
Bug 22692: Unit tests
Bug 22692: Check for patron using cardnumber and userid Bug 22692: Unit tests Bug 22692: Check for patron using cardnumber and userid Bug 22692: Unit tests Bug 22692: Check for patron using cardnumber and userid |
||
|
Description
Nick Clemens (kidclamp)
2019-04-12 01:23:09 UTC
Created attachment 87826 [details] [review] Bug 22692: Unit tests 1 - Apply just this patch 2 - prove -v t/db_dependent/Auth.t 3 - Failure 4 - Apply second patch 5 - prove -v t/db_dependent/Auth.t 6 - Success Created attachment 87827 [details] [review] Bug 22692: Check for patron using cardnumber and userid TO test: 1 - Set failed login attempts to 1 2 - Attempt a login with a userid and bad password, no success 3 - Attempt a login with userid and correct password, prevented because locked 4 - Attempt a login with cardnumber and right password, you are logged in 5 - Log out, try again with userid and correct password, prevented because locked? 6 - Apply patch 7 - Repeat 1-3 to lock account 8 - Attempt logging in with cardnumber, you are prevented Created attachment 87903 [details] [review] Bug 22692: Unit tests 1 - Apply just this patch 2 - prove -v t/db_dependent/Auth.t 3 - Failure 4 - Apply second patch 5 - prove -v t/db_dependent/Auth.t 6 - Success Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 87904 [details] [review] Bug 22692: Check for patron using cardnumber and userid TO test: 1 - Set failed login attempts to 1 2 - Attempt a login with a userid and bad password, no success 3 - Attempt a login with userid and correct password, prevented because locked 4 - Attempt a login with cardnumber and right password, you are logged in 5 - Log out, try again with userid and correct password, prevented because locked? 6 - Apply patch 7 - Repeat 1-3 to lock account 8 - Attempt logging in with cardnumber, you are prevented Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Well spotted.. Signing off. Created attachment 87976 [details] [review] Bug 22692: Unit tests 1 - Apply just this patch 2 - prove -v t/db_dependent/Auth.t 3 - Failure 4 - Apply second patch 5 - prove -v t/db_dependent/Auth.t 6 - Success Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 87977 [details] [review] Bug 22692: Check for patron using cardnumber and userid TO test: 1 - Set failed login attempts to 1 2 - Attempt a login with a userid and bad password, no success 3 - Attempt a login with userid and correct password, prevented because locked 4 - Attempt a login with cardnumber and right password, you are logged in 5 - Log out, try again with userid and correct password, prevented because locked? 6 - Apply patch 7 - Repeat 1-3 to lock account 8 - Attempt logging in with cardnumber, you are prevented Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Ok but then we should send $patron to checkpw_internal and clean it a bit. For another bug report of course ;) Pushed to 18.11.x for 18.11.05 Pushed to 18.05.x for 18.05.12 Unit test does not apply easy on 17.11.x. Since its near end of live we may let it like this. Awesome work all! Pushed to master for 19.05 |