Bug 12227 - Remove demo user functionality
Summary: Remove demo user functionality
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Whiteboard:
Keywords: release-notes-needed
Depends on:
Blocks:
 
Reported: 2014-05-09 15:51 UTC by Galen Charlton
Modified: 2018-04-06 13:24 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 12227: Remove the demo functionality (18.48 KB, patch)
2017-09-27 17:39 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 12227: Remove the demo functionality (18.49 KB, patch)
2017-10-04 21:06 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 12227: Remove the demo functionality (18.54 KB, patch)
2017-10-30 10:21 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2014-05-09 15:51:57 UTC
There is a legacy authentication mode whereby if you enable a "demo" setting in koha-conf.xml, one can log in as a user with username "demo" and password "demo".

This user acts as a superlibrarian with two exceptions:

[1] not able to modify system preferences
[2] not able to save changes to MARC frameworks

This represents a wart in the authentication code for a very limited use case -- and warts in authentication code can turn into security exposures.

The special case should be removed.  If folks still want to be able to create demo systems with high-privilege staff accounts that can't touch MARC frameworks or system preferences, that can be addressed by adding a couple more granular permissions.
Comment 1 Martin Renvoize 2014-12-31 07:10:47 UTC
I spotted this code recently and can only agree that it's a nasty case, with agreement I'de be more than happy to strip it out.
Comment 2 Jonathan Druart 2017-09-27 17:39:51 UTC
Created attachment 67407 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.
Comment 3 Alex Buckley 2017-10-04 02:21:56 UTC
What is the demo setting in koha-conf.xml that needs to be enabled? I cannot find the string 'demo' in the aforementioned file
Comment 4 Jonathan Druart 2017-10-04 15:53:33 UTC
(In reply to Alex Buckley from comment #3)
> What is the demo setting in koha-conf.xml that needs to be enabled? I cannot
> find the string 'demo' in the aforementioned file

This patch removes the demo functionality. It has never been implemented fully, it is expected not to see it in the config file.
Comment 5 Alex Buckley 2017-10-04 21:06:30 UTC
Created attachment 67617 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Comment 6 Kyle M Hall 2017-10-30 10:21:50 UTC
Created attachment 68837 [details] [review]
Bug 12227: Remove the demo functionality

This is a legacy mode that did not really work.

Test plan:
Play with frameworks and sysprefs and confirm the changes
(add/del/update) are taken into account.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Jonathan Druart 2017-12-11 14:35:12 UTC
Pushed to master for 18.05, thanks to everybody involved!
Comment 8 Nick Clemens 2017-12-14 17:46:23 UTC
Awesome work all! Skipping for 17.11, enhancement.