Bug 22692

Summary: Logging in via cardnumber circumvents account logout
Product: Koha Reporter: Nick Clemens <nick>
Component: AuthenticationAssignee: Nick Clemens <nick>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: dpavlin, fridolin.somers, jonathan.druart, katrin.fischer, martin.renvoize, nick
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05, 18.05.12
Attachments: Bug 22692: Unit tests
Bug 22692: Check for patron using cardnumber and userid
Bug 22692: Unit tests
Bug 22692: Check for patron using cardnumber and userid
Bug 22692: Unit tests
Bug 22692: Check for patron using cardnumber and userid

Description Nick Clemens 2019-04-12 01:23:09 UTC
To recreate:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because locked
4 - Attempt a login with cardnumber and right password, you are logged in
5 - Log out, try again with userid and correct password, prevented because locked?
Comment 1 Nick Clemens 2019-04-12 01:26:50 UTC
Created attachment 87826 [details] [review]
Bug 22692: Unit tests

1 - Apply just this patch
2 - prove -v t/db_dependent/Auth.t
3 - Failure
4 - Apply second patch
5 - prove -v t/db_dependent/Auth.t
6 - Success
Comment 2 Nick Clemens 2019-04-12 01:26:53 UTC
Created attachment 87827 [details] [review]
Bug 22692: Check for patron using cardnumber and userid

TO test:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because
locked
4 - Attempt a login with cardnumber and right password, you are logged
in
5 - Log out, try again with userid and correct password, prevented
because locked?
6 - Apply patch
7 - Repeat 1-3 to lock account
8 - Attempt logging in with cardnumber, you are prevented
Comment 3 Martin Renvoize 2019-04-12 12:53:47 UTC
Created attachment 87903 [details] [review]
Bug 22692: Unit tests

1 - Apply just this patch
2 - prove -v t/db_dependent/Auth.t
3 - Failure
4 - Apply second patch
5 - prove -v t/db_dependent/Auth.t
6 - Success

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2019-04-12 12:53:50 UTC
Created attachment 87904 [details] [review]
Bug 22692: Check for patron using cardnumber and userid

TO test:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because
locked
4 - Attempt a login with cardnumber and right password, you are logged
in
5 - Log out, try again with userid and correct password, prevented
because locked?
6 - Apply patch
7 - Repeat 1-3 to lock account
8 - Attempt logging in with cardnumber, you are prevented

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2019-04-12 12:54:11 UTC
Well spotted.. Signing off.
Comment 6 Chris Cormack 2019-04-15 02:12:42 UTC
Created attachment 87976 [details] [review]
Bug 22692: Unit tests

1 - Apply just this patch
2 - prove -v t/db_dependent/Auth.t
3 - Failure
4 - Apply second patch
5 - prove -v t/db_dependent/Auth.t
6 - Success

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 7 Chris Cormack 2019-04-15 02:13:05 UTC
Created attachment 87977 [details] [review]
Bug 22692: Check for patron using cardnumber and userid

TO test:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because
locked
4 - Attempt a login with cardnumber and right password, you are logged
in
5 - Log out, try again with userid and correct password, prevented
because locked?
6 - Apply patch
7 - Repeat 1-3 to lock account
8 - Attempt logging in with cardnumber, you are prevented

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 8 Jonathan Druart 2019-04-24 22:40:11 UTC
Ok but then we should send $patron to checkpw_internal and clean it a bit. For another bug report of course ;)
Comment 9 Martin Renvoize 2019-04-26 16:07:56 UTC
Pushed to 18.11.x for 18.11.05
Comment 10 Fridolin Somers 2019-04-30 07:33:12 UTC
Pushed to 18.05.x for 18.05.12
Comment 11 Fridolin Somers 2019-04-30 07:49:39 UTC
Unit test does not apply easy on 17.11.x.
Since its near end of live we may let it like this.
Comment 12 Nick Clemens 2019-05-02 13:52:36 UTC
Awesome work all!

Pushed to master for 19.05