Bug 31431

Summary: Cannot change one's own userid if logged in as staff
Product: Koha Reporter: Joonas Kylmälä <joonas.kylmala>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: gmcharlt, januszop, kyle.m.hall, magnus
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Joonas Kylmälä 2022-08-21 10:53:09 UTC
I cannot change the userid for my own account in the staff interface, if I do that I get the following error on any subsequent page I try to access:

> Can't use string ("Koha::Patron") as a HASH ref while "strict refs" in use at /kohadevbox/koha/Koha/Object.pm line 830

Could the user session be tied into a specific userid, and if that changes things break?
Comment 1 Katrin Fischer 2022-08-21 10:54:55 UTC
Hm I think this used to work, but after changing I usually needed to log in again being logged out.
Comment 2 Magnus Enger 2023-01-25 01:06:11 UTC
I can confirm this on 22.05.08. After changing my userid in the staff client, I could only get "Internal Server Error" whatever I clicked on.
Comment 3 Janusz Kaczmarek 2023-05-05 10:57:14 UTC
Same effect (Internal Server Error) in 22.11.03.  In log we find:

Can't call method "password_expired" on an undefined value at /usr/share/koha/lib/C4/Auth.pm line 1785.

This is because, in function C4::Auth::check_cookie_auth, the following is done:

            my $userid   = $session->param('id');
[...]
            my $patron = Koha::Patrons->find({ userid => $userid });
            $patron = Koha::Patrons->find({ cardnumber => $userid })
              unless $patron;
            return ("password_expired", undef ) if $patron->password_expired;

$userid is taken from stored session data and contains the old user login (= userid).  At the same time, the content of the borrowers table is already updated with the new userid.  So no patron object is found.  As a consequence, $patron->password_expired is called on an undefined patron (without checking if it exists).

So, maybe while self-modifying the userid the session data should also be updated?  Would it work?  And how about SSO methods, should any of them be used?
Comment 4 Katrin Fischer 2023-06-17 11:06:33 UTC

*** This bug has been marked as a duplicate of bug 33851 ***
Comment 5 Katrin Fischer 2023-06-17 11:42:41 UTC

*** This bug has been marked as a duplicate of bug 33815 ***