Bug 20632 - Staff users without superlibrarian can't log into OPAC
Summary: Staff users without superlibrarian can't log into OPAC
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 15492
Blocks:
  Show dependency treegraph
 
Reported: 2018-04-22 09:01 UTC by Katrin Fischer
Modified: 2023-02-02 08:05 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 20632: Alert when SCO or SCI user in OPAC login page (3.21 KB, patch)
2023-02-02 07:34 UTC, Fridolin Somers
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2018-04-22 09:01:50 UTC
Ok, I hope it's not me, but in case it isn't, this is a bad bug:

- Create or change your staff user to have all available permissions BUT superlibrarian
- Log out
- Log into staff - it works. Log out.
- Log into OPAC - it won't work. Not good at all.


This is bad for at least 2 reasons:
- Often staff accounts are used like normal patron accounts by staff.
- Because of permissions, sometimes the OPAC is the only place a staff user can change their password.

Tested on master after a reset_all.
Comment 1 Jonathan Druart 2018-04-23 13:57:53 UTC
Caused by bug 15492
Comment 2 Jonathan Druart 2018-04-23 14:00:27 UTC
It's not a bug actually, but we need to do something to avoid this configuration issue: the new permissions self_check must not be set for normal users, we may need to add a warning on the permission page.
Comment 3 Katrin Fischer 2018-04-24 05:32:19 UTC
Ok, I think adding a note to Self check modules permission could help here for now. At least then, staring on permissions will give you a hint :)

Maybe: Set only for self-check users, prevents OPAC login.

OK?
Comment 4 Jonathan Druart 2018-04-25 15:01:33 UTC
There is a note already:

" self_checkin_module Log into the self check-in module. Note: this permission prevents the patron from using any other OPAC functionality "

https://screenshots.firefox.com/578CGKmzkgVDIjEa/pro.kohadev.org
Comment 5 Katrin Fischer 2018-04-25 18:40:21 UTC
You are right, I missed it because i was looking at the top level permission with the others collapsed.
Comment 6 Jonathan Druart 2018-05-03 12:48:32 UTC
Maybe we should add a warning/message on the patron's defail page?
Comment 7 Tomás Cohen Arazi 2018-05-03 19:15:48 UTC
(In reply to Jonathan Druart from comment #6)
> Maybe we should add a warning/message on the patron's defail page?

I agree. We could add something noticeable that tells the patron situation. I'm not sure where to put it. Adding Owen to the conversation. Sorry Owen!
Comment 8 Fridolin Somers 2023-02-01 20:42:27 UTC
I spend 1 hour searching for this.
I reopen to add a warning message.
Comment 9 Fridolin Somers 2023-02-02 07:34:11 UTC
Created attachment 145991 [details] [review]
Bug 20632: Alert when SCO or SCI user in OPAC login page

Special patrons for self check-out/check-in are not allowed to login
into OPAC.

This patch adds an alter message in OPAC login page when
authentification is tried with SCO/SCI user.

Test plan :
1) SCO
1.1) Use koha-testing-docker that is configured with patron 'self_checkout'
1.2) Go to OPAC main page, not logged-in
1.3) Try to login with login 'self_checkout' and password 'self_checkout'
=> You see an alert 'You can not loggin with self check-out user'
2) SCI
2.1) Create a new patron with login 'self_checkin', password 'self_checkin'
2.2) Define on him the permission 'self_checkin_module'
2.3) Go to OPAC main page, not logged-in
2.4) Try to login with login 'self_checkin' and password 'self_checkin'
=> You see an alert 'You can not loggin with self check-in user'
Comment 10 Jonathan Druart 2023-02-02 07:41:25 UTC
I don't think this is valid, that could be considered a security issue to provide such info.

C4::Auth changes without tests => FQA anyway.
Comment 11 Fridolin Somers 2023-02-02 08:05:55 UTC
In this case a less specific message ?
Like "Login failed because of technical issue"