Bug 20170 - Patron account can be renewed multiple times in a row without noticing
Summary: Patron account can be renewed multiple times in a row without noticing
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low trivial (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-02-09 17:37 UTC by Chris Slone
Modified: 2023-10-01 20:57 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Slone 2018-02-09 17:37:39 UTC
If you renew a patron's registration by using the 'Renew' link that is displayed after the expiration warning on the checkout screen, and you click said link more than once, the dateexpiry gets changed and extended a requisite number of times. In other words, if your enrollment period is two years and you double-click this link, the new expiration date will be end up being four years from today. If you triple click it, it will be 6 years. Quadruple click it for 8 years. (It's not possible to do this using the dropdown renewal option as it produces a dialogue box asking for the user to confirm the registration renewal.)

To replicate:
1.) Create or select a patron category that has an enrollment period that is calculated in months (not a fixed date, for this example I use 24 months
2.) Find or create a patron in that category with an expired account
3.) Open this patron's account for checkout and find the warning about the patron's expired account
4.) Double click 'Renew'
5.) When the page reloads confirm that the expiration date is now 48 months from today (rather than the 24 dictated by the category enrollment period)
Comment 1 Chris Slone 2018-02-09 17:39:49 UTC
This may be related to bug 15792.
Comment 2 Katrin Fischer 2018-02-18 11:36:08 UTC
Would a confirm message with the new date work here?

I think sometimes it might be wanted to be able to renew multiple times, so not sure we should block this totally. Maybe just needs a security question.
Comment 3 Katrin Fischer 2023-10-01 20:57:24 UTC
When you renew from the patron menu, we have a confirmation alert, but when you click the renew link on an already expired account there is no alert.

In both cases the page reloads and shows the new exiration date in a message box.