Summary: | SCO module should display error message when attempting to log in with wrong username and password | ||
---|---|---|---|
Product: | Koha | Reporter: | Lucas Gass (lukeg) <lucas> |
Component: | Self checkout | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | jsalamon |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Lucas Gass (lukeg)
2023-08-24 21:06:20 UTC
Hm, isn't this a security issue? We should not confirm existance or non-existance of the userid? (In reply to Katrin Fischer from comment #1) > Hm, isn't this a security issue? We should not confirm existance or > non-existance of the userid? You mean when 'SelfCheckoutByLogin' is set to 'cardnumber'? I can see how that is problematic. But when it is set to 'username and password' we should be able to display a message saying your password/username combo is incorrect, right? This is a usability problem for users. It's pretty confusing for users to just see a screen flash with no indication of what is going wrong. I think we can do that - similar to the OPAC one maybe? (In reply to Katrin Fischer from comment #3) > I think we can do that - similar to the OPAC one maybe? +1 The functionality Cuyahoga is seeking would be very basic to mitigate privacy or security concerns. After submitting invalid barcode-username and/or PIN-password info on the SCO login screen only, the software would return a generic text display similar to: "Login information is not valid. Please try again." |