Bug 21533 - Do not allow password recovery for administrative locked patrons (see 21336)
Summary: Do not allow password recovery for administrative locked patrons (see 21336)
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on: 21336
Blocks:
  Show dependency treegraph
 
Reported: 2018-10-10 12:28 UTC by Marcel de Rooy
Modified: 2020-01-06 20:15 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 21533: Do not allow password recovery for administrative locked patrons (2.00 KB, patch)
2018-10-10 13:18 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 21533: Do not allow password recovery for administrative locked patrons (2.01 KB, patch)
2019-04-26 12:07 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 21533: Do not allow password recovery for administrative locked patrons (2.06 KB, patch)
2019-04-26 19:52 UTC, Bouzid Fergani
Details | Diff | Splinter Review
Bug 21533: Do not allow password recovery for administrative locked patrons (2.13 KB, patch)
2019-05-01 09:21 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2018-10-10 12:28:48 UTC

    
Comment 1 Marcel de Rooy 2018-10-10 13:18:12 UTC
Created attachment 80348 [details] [review]
Bug 21533: Do not allow password recovery for administrative locked patrons

Depends on bug 21336 for the ADMINISTRATIVE_LOCKOUT constant.

This is a bit lazy solution (but good enough): The account will not be found
when recovering the password. The user should contact the library. Since
the library chose to lock the account, that seems appropriate.

Test plan:
Select a borrower and set login_attempts to -1. Via mysql command line or
with Koha::Patrons->find(borrowernumber)->lock.
Enable password recovery.
Try to recover password from OPAC. You should fail with 'Not found, contact
the library'.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Owen Leonard 2019-04-26 12:07:03 UTC
Created attachment 88904 [details] [review]
Bug 21533: Do not allow password recovery for administrative locked patrons

Depends on bug 21336 for the ADMINISTRATIVE_LOCKOUT constant.

This is a bit lazy solution (but good enough): The account will not be found
when recovering the password. The user should contact the library. Since
the library chose to lock the account, that seems appropriate.

Test plan:
Select a borrower and set login_attempts to -1. Via mysql command line or
with Koha::Patrons->find(borrowernumber)->lock.
Enable password recovery.
Try to recover password from OPAC. You should fail with 'Not found, contact
the library'.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Bouzid Fergani 2019-04-26 19:52:13 UTC
Created attachment 88967 [details] [review]
Bug 21533: Do not allow password recovery for administrative locked patrons

Depends on bug 21336 for the ADMINISTRATIVE_LOCKOUT constant.

This is a bit lazy solution (but good enough): The account will not be found
when recovering the password. The user should contact the library. Since
the library chose to lock the account, that seems appropriate.

Test plan:
Select a borrower and set login_attempts to -1. Via mysql command line or
with Koha::Patrons->find(borrowernumber)->lock.
Enable password recovery.
Try to recover password from OPAC. You should fail with 'Not found, contact
the library'.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Comment 4 Martin Renvoize (ashimema) 2019-05-01 09:21:47 UTC
Created attachment 89159 [details] [review]
Bug 21533: Do not allow password recovery for administrative locked patrons

Depends on bug 21336 for the ADMINISTRATIVE_LOCKOUT constant.

This is a bit lazy solution (but good enough): The account will not be found
when recovering the password. The user should contact the library. Since
the library chose to lock the account, that seems appropriate.

Test plan:
Select a borrower and set login_attempts to -1. Via mysql command line or
with Koha::Patrons->find(borrowernumber)->lock.
Enable password recovery.
Try to recover password from OPAC. You should fail with 'Not found, contact
the library'.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize (ashimema) 2019-05-01 09:22:15 UTC
Simple patch that works well. Passing QA
Comment 6 Marcel de Rooy 2019-05-01 10:53:44 UTC
Thx Owen, Bouzid and Martin
Comment 7 Nick Clemens (kidclamp) 2019-05-10 12:24:59 UTC
Awesome work all!

Pushed to master for 19.05
Comment 8 Martin Renvoize (ashimema) 2019-05-17 13:31:40 UTC
Enhancement will not be backported to 18.11.x series.