Bug 36679

Summary:	Anonymous patron is not blocked from checkout via self check
Product:	Koha	Reporter:	Christopher Brannon <cbrannon>
Component:	Self checkout	Assignee:	Lucas Gass (lukeg) <lucas>
Status:	Pushed to oldstable ---	QA Contact:	Martin Renvoize (ashimema) <martin.renvoize>
Severity:	normal
Priority:	P5 - low	CC:	david, fridolin.somers, lucas, wainuiwitikapark
Version:	Main
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36695
Change sponsored?:	---	Patch complexity:	Trivial patch
Documentation contact:		Documentation submission:
Text to go in the release notes:	This fixes the web-based self-checkout system to prevent the AnonymousPatron from checking out items.	Version(s) released in:	24.11.00,24.05.02,23.11.07
Circulation function:
Bug Depends on:
Bug Blocks:	37104
Attachments:	Bug 36679: Prevent SCO login for the AnonymousPatron Bug 36679: Prevent SCO login for the AnonymousPatron Bug 36679: Prevent SCO login for the AnonymousPatron

Description Christopher Brannon 2024-04-23 20:29:34 UTC

The anonymous patron is not allowed to checkout through the staff module, but it appears that you can login as this user on the self check and check out items.

While it is more likely this could be exploited with a random library card number, this does create a hole in blocking circ on this account.

Comment 1 Christopher Brannon 2024-04-24 18:58:49 UTC

This also seems to be the case with SIP transactions.

I've restricted the anonymous account.

Comment 2 Christopher Brannon 2024-04-24 19:01:20 UTC

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!

I would HIGHLY suggest preventing the account from using anonymous as the cardnumber/username.

Koha should also block this patron from checking out, just like it does in the staff interface.  Maybe it should just be automatically restricted account indefinitely?

Comment 3 Lucas Gass (lukeg) 2024-04-24 20:07:12 UTC

Created attachment 165487 [details] [review]
Bug 36679: Prevent SCO login for the AnonymousPatron

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.

Comment 4 Lucas Gass (lukeg) 2024-04-24 20:08:35 UTC

(In reply to Christopher Brannon from comment #1)
> This also seems to be the case with SIP transactions.
> 
> I've restricted the anonymous account.

Christopher,

Can you file a separate bug outlining how you were able to do this via a SIP transaction? 

Thanks!

Comment 5 Lucas Gass (lukeg) 2024-04-24 20:19:21 UTC

This blocks the AnonymousPatron from logging in at the SCO module. Is there any reason that the AnonymousPatron should be able to log into anything? ( OPAC/SCO/Staff )

Maybe we should block this at Auth.pm?

Comment 6 Christopher Brannon 2024-04-24 22:28:03 UTC

(In reply to Lucas Gass from comment #4)
> (In reply to Christopher Brannon from comment #1)
> > This also seems to be the case with SIP transactions.
> > 
> > I've restricted the anonymous account.
> 
> Christopher,
> 
> Can you file a separate bug outlining how you were able to do this via a SIP
> transaction? 
> 
> Thanks!

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36695

Comment 7 David Nind 2024-05-01 21:33:14 UTC

Created attachment 166025 [details] [review]
Bug 36679: Prevent SCO login for the AnonymousPatron

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.

Signed-off-by: David Nind <david@davidnind.com>

Comment 8 David Nind 2024-05-01 21:35:00 UTC

Testing notes using KTD:

1. Step 5: [hostname]/cgi-bin/koha/sco/sco-main.pl

2. Step 8: While the URL is /cgi-bin/koha/opac-main.pl, the page has the log in form in the middle and none of the normal header (including the OPAC search box).

Comment 9 Martin Renvoize (ashimema) 2024-06-04 12:15:29 UTC

Created attachment 167392 [details] [review]
Bug 36679: Prevent SCO login for the AnonymousPatron

1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library.  It should auto login.  Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 10 Martin Renvoize (ashimema) 2024-06-04 12:15:55 UTC

Nice simple fix, passing QA

Comment 11 Martin Renvoize (ashimema) 2024-06-10 15:27:25 UTC

Thanks for all the hard work!

Pushed to main for the next 24.11.00 release as RM Assistant

Comment 12 Lucas Gass (lukeg) 2024-06-27 22:02:36 UTC

Backported to 24.05.x for upcoming 24.05.02

Comment 13 Fridolin Somers 2024-07-17 13:39:50 UTC

Cool.
We should consider creating Koha::Patron->is_anonymous()

Comment 14 Fridolin Somers 2024-07-17 13:41:40 UTC

Pushed to 23.11.x for 23.11.07

Comment 15 Wainui Witika-Park 2024-07-19 03:23:22 UTC

not backporting to 23.05.x unless requested