| Summary: | SCO module should display error message when attempting to log in with wrong username and password | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Lucas Gass (lukeg) <lucas> |
| Component: | Self checkout | Assignee: | Bugs List <koha-bugs> |
| Status: | RESOLVED DUPLICATE | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | jsalamon |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Lucas Gass (lukeg)
2023-08-24 21:06:20 UTC
Hm, isn't this a security issue? We should not confirm existance or non-existance of the userid? (In reply to Katrin Fischer from comment #1) > Hm, isn't this a security issue? We should not confirm existance or > non-existance of the userid? You mean when 'SelfCheckoutByLogin' is set to 'cardnumber'? I can see how that is problematic. But when it is set to 'username and password' we should be able to display a message saying your password/username combo is incorrect, right? This is a usability problem for users. It's pretty confusing for users to just see a screen flash with no indication of what is going wrong. I think we can do that - similar to the OPAC one maybe? (In reply to Katrin Fischer from comment #3) > I think we can do that - similar to the OPAC one maybe? +1 The functionality Cuyahoga is seeking would be very basic to mitigate privacy or security concerns. After submitting invalid barcode-username and/or PIN-password info on the SCO login screen only, the software would return a generic text display similar to: "Login information is not valid. Please try again." |