Bug 22692 - Logging in via cardnumber circumvents account logout
Summary: Logging in via cardnumber circumvents account logout
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Nick Clemens
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-12 01:23 UTC by Nick Clemens
Modified: 2019-10-14 20:02 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05, 18.05.12


Attachments
Bug 22692: Unit tests (2.43 KB, patch)
2019-04-12 01:26 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 22692: Check for patron using cardnumber and userid (1.12 KB, patch)
2019-04-12 01:26 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 22692: Unit tests (2.50 KB, patch)
2019-04-12 12:53 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 22692: Check for patron using cardnumber and userid (1.19 KB, patch)
2019-04-12 12:53 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 22692: Unit tests (2.55 KB, patch)
2019-04-15 02:12 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 22692: Check for patron using cardnumber and userid (1.24 KB, patch)
2019-04-15 02:13 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2019-04-12 01:23:09 UTC
To recreate:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because locked
4 - Attempt a login with cardnumber and right password, you are logged in
5 - Log out, try again with userid and correct password, prevented because locked?
Comment 1 Nick Clemens 2019-04-12 01:26:50 UTC
Created attachment 87826 [details] [review]
Bug 22692: Unit tests

1 - Apply just this patch
2 - prove -v t/db_dependent/Auth.t
3 - Failure
4 - Apply second patch
5 - prove -v t/db_dependent/Auth.t
6 - Success
Comment 2 Nick Clemens 2019-04-12 01:26:53 UTC
Created attachment 87827 [details] [review]
Bug 22692: Check for patron using cardnumber and userid

TO test:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because
locked
4 - Attempt a login with cardnumber and right password, you are logged
in
5 - Log out, try again with userid and correct password, prevented
because locked?
6 - Apply patch
7 - Repeat 1-3 to lock account
8 - Attempt logging in with cardnumber, you are prevented
Comment 3 Martin Renvoize 2019-04-12 12:53:47 UTC
Created attachment 87903 [details] [review]
Bug 22692: Unit tests

1 - Apply just this patch
2 - prove -v t/db_dependent/Auth.t
3 - Failure
4 - Apply second patch
5 - prove -v t/db_dependent/Auth.t
6 - Success

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2019-04-12 12:53:50 UTC
Created attachment 87904 [details] [review]
Bug 22692: Check for patron using cardnumber and userid

TO test:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because
locked
4 - Attempt a login with cardnumber and right password, you are logged
in
5 - Log out, try again with userid and correct password, prevented
because locked?
6 - Apply patch
7 - Repeat 1-3 to lock account
8 - Attempt logging in with cardnumber, you are prevented

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2019-04-12 12:54:11 UTC
Well spotted.. Signing off.
Comment 6 Chris Cormack 2019-04-15 02:12:42 UTC
Created attachment 87976 [details] [review]
Bug 22692: Unit tests

1 - Apply just this patch
2 - prove -v t/db_dependent/Auth.t
3 - Failure
4 - Apply second patch
5 - prove -v t/db_dependent/Auth.t
6 - Success

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 7 Chris Cormack 2019-04-15 02:13:05 UTC
Created attachment 87977 [details] [review]
Bug 22692: Check for patron using cardnumber and userid

TO test:
1 - Set failed login attempts to 1
2 - Attempt a login with a userid and bad password, no success
3 - Attempt a login with userid and correct password, prevented because
locked
4 - Attempt a login with cardnumber and right password, you are logged
in
5 - Log out, try again with userid and correct password, prevented
because locked?
6 - Apply patch
7 - Repeat 1-3 to lock account
8 - Attempt logging in with cardnumber, you are prevented

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 8 Jonathan Druart 2019-04-24 22:40:11 UTC
Ok but then we should send $patron to checkpw_internal and clean it a bit. For another bug report of course ;)
Comment 9 Martin Renvoize 2019-04-26 16:07:56 UTC
Pushed to 18.11.x for 18.11.05
Comment 10 Fridolin SOMERS 2019-04-30 07:33:12 UTC
Pushed to 18.05.x for 18.05.12
Comment 11 Fridolin SOMERS 2019-04-30 07:49:39 UTC
Unit test does not apply easy on 17.11.x.
Since its near end of live we may let it like this.
Comment 12 Nick Clemens 2019-05-02 13:52:36 UTC
Awesome work all!

Pushed to master for 19.05