Bug 30240

Summary: Re-authentication on sensitive actions
Product: Koha Reporter: Magnus Enger <magnus>
Component: Staff interfaceAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: gmcharlt, lisette
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Magnus Enger 2022-03-07 11:31:13 UTC
It would be nice if it was possible to give extra protection to some sensitive actions in the staff client, such as maybe updating borrowers and definitely changing sysprefs. This could be done by asking the user to re-authenticate, before carrying out the action. Extra nice if this could be turned on and off for individual actions. 

https://opsec.readthedocs.io/en/latest/user/re-authentication-on-sensitive-actions.html
Comment 1 Lisette Scheer 2022-03-09 17:02:33 UTC
(In reply to Magnus Enger from comment #0)
> It would be nice if it was possible to give extra protection to some
> sensitive actions in the staff client, such as maybe updating borrowers and
> definitely changing sysprefs. This could be done by asking the user to
> re-authenticate, before carrying out the action. Extra nice if this could be
> turned on and off for individual actions. 
> 
> https://opsec.readthedocs.io/en/latest/user/re-authentication-on-sensitive-
> actions.html

I like this for sys prefs at least. I think it could be very time consuming if circ staff had to re-enter passwords every time we edited a patron, which happens very frequently. Although for changing prefs/changing to staff patron type. 

Additional places it might be good:
Delete all items
Batch patron deletion
Batch record deletion.