Bug 34612

Summary: SCO module should display error message when attempting to log in with wrong username and password
Product: Koha Reporter: Lucas Gass (lukeg) <lucas>
Component: Self checkoutAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: jsalamon
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Lucas Gass (lukeg) 2023-08-24 21:06:20 UTC
To recreate:

1. Enable WebBasedSelfCheck
2. Have SelfCheckoutByLogin set to 'username and password'
3. Go to /cgi-bin/koha/sco/sco-main.pl and try login in with erroneous login credentials.
4. Screen flashes and the user is returned to blank login screen with no indication of what has gone wrong.
5. Switch 'SelfCheckoutByLogin' to 'cardnumber' and try an erroneous card number 
6. See the message:


Sorry

The userid X was not found in the database. Please try again.
Comment 1 Katrin Fischer 2023-08-24 21:08:07 UTC
Hm, isn't this a security issue? We should not confirm existance or non-existance of the userid?
Comment 2 Lucas Gass (lukeg) 2023-08-24 21:19:35 UTC
(In reply to Katrin Fischer from comment #1)
> Hm, isn't this a security issue? We should not confirm existance or
> non-existance of the userid?

You mean when 'SelfCheckoutByLogin' is set to 'cardnumber'? I can see how that is problematic. 

But when it is set to 'username and password' we should be able to display a message saying your password/username combo is incorrect, right? 

This is a usability problem for users. It's pretty confusing for users to just see a screen flash with no indication of what is going wrong.
Comment 3 Katrin Fischer 2023-08-24 21:29:57 UTC
I think we can do that - similar to the OPAC one maybe?
Comment 4 Lucas Gass (lukeg) 2023-08-24 22:19:18 UTC
(In reply to Katrin Fischer from comment #3)
> I think we can do that - similar to the OPAC one maybe?

+1
Comment 5 Joe Salamon 2023-10-18 17:36:20 UTC
The functionality Cuyahoga is seeking would be very basic to mitigate privacy or security concerns. After submitting invalid barcode-username and/or PIN-password info on the SCO login screen only, the software would return a generic text display similar to: "Login information is not valid. Please try again."