There is a legacy authentication mode whereby if you enable a "demo" setting in koha-conf.xml, one can log in as a user with username "demo" and password "demo". This user acts as a superlibrarian with two exceptions: [1] not able to modify system preferences [2] not able to save changes to MARC frameworks This represents a wart in the authentication code for a very limited use case -- and warts in authentication code can turn into security exposures. The special case should be removed. If folks still want to be able to create demo systems with high-privilege staff accounts that can't touch MARC frameworks or system preferences, that can be addressed by adding a couple more granular permissions.
I spotted this code recently and can only agree that it's a nasty case, with agreement I'de be more than happy to strip it out.
Created attachment 67407 [details] [review] Bug 12227: Remove the demo functionality This is a legacy mode that did not really work. Test plan: Play with frameworks and sysprefs and confirm the changes (add/del/update) are taken into account.
What is the demo setting in koha-conf.xml that needs to be enabled? I cannot find the string 'demo' in the aforementioned file
(In reply to Alex Buckley from comment #3) > What is the demo setting in koha-conf.xml that needs to be enabled? I cannot > find the string 'demo' in the aforementioned file This patch removes the demo functionality. It has never been implemented fully, it is expected not to see it in the config file.
Created attachment 67617 [details] [review] Bug 12227: Remove the demo functionality This is a legacy mode that did not really work. Test plan: Play with frameworks and sysprefs and confirm the changes (add/del/update) are taken into account. Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Created attachment 68837 [details] [review] Bug 12227: Remove the demo functionality This is a legacy mode that did not really work. Test plan: Play with frameworks and sysprefs and confirm the changes (add/del/update) are taken into account. Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Pushed to master for 18.05, thanks to everybody involved!
Awesome work all! Skipping for 17.11, enhancement.
found some remnants: https://git.koha-community.org/Koha-community/Koha/search?q=C4%3A%3AContext+config+demo https://git.koha-community.org/Koha-community/Koha/src/branch/master/svc/config/systempreferences#L98
(above comment re-posted from my words by JD, we had some antispam issues) found some remnants of "C4::Context->config('demo')": in /svc/config/systempreferences line 68: `unless ( C4::Context->config('demo') ) { ... ` it's never failing because it returns _REFERENCE_TO_HASH_, even the hash is empty: ``` sub set_preferences { warn C4::Context->config( 'demo' ); warn C4::Context->config( 'demo' ) ? 'TRUTH' : 'FALSE'; warn Dumper(C4::Context->config( 'demo' )); unless ( C4::Context->config('demo') ) { ... ``` Gives: [2021/09/20 10:42:56] [WARN] HASH(0x5646ead56e00) [2021/09/20 10:42:56] [WARN] TRUTH [2021/09/20 10:42:56] [WARN] $VAR1 = {}; and despite this "hash truth" issue also, by the way, as I see, this "demo" was removed everywhere so should be in svc/config/systempreferences too.
Created Bug 29056