Bug 24738 - Online registration should check if patron is registering for an already existing account
Summary: Online registration should check if patron is registering for an already exis...
Status: REOPENED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-26 21:39 UTC by Christopher Brannon
Modified: 2024-01-10 19:35 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2020-02-26 21:39:39 UTC
I think it would be good, if online registration noted that an account with the e-mail address a patron is registering with is already in use.

I also think, that registration should send a code to the e-mail address before registration is complete.  If the address already exists, it will send an e-mail to the address saying that someone is trying to register with that e-mail address.  If it is not you, contact your library.  If it is, and you are registering an account for another family member, use this code to complete the process.

This will serve to make people aware that already have a card that they are trying to register an already existing account, but also allow those who use the same e-mail address for more than one family member to proceed.
Comment 1 Katrin Fischer 2020-02-26 21:43:32 UTC
Please rethink the bug title to make it more specific :)
Comment 2 Katrin Fischer 2024-01-06 13:38:17 UTC
I think this bug describes 2 things:

* Show a message that an email has already been registered: We should not do this, as it would give away that the email address exists and is a user at the library. This is a privacy concern.

* Sent an email to verify: we already have email verification for self registration that works this way.
Comment 3 Christopher Brannon 2024-01-09 18:21:05 UTC
(In reply to Katrin Fischer from comment #2)

> * Show a message that an email has already been registered: We should not do
> this, as it would give away that the email address exists and is a user at
> the library. This is a privacy concern.

I have not known a system that doesn't either say that the email address is already in use if you try to register under it, or at least give a generic error message.

However, as I think through this specific piece, since a patron is trying to register under the email address, it is assumed that if it is legit, they would have access to either the email or the person that has access to it, and therefore noting that the email address is already in use may not be necessary.
 
> * Sent an email to verify: we already have email verification for self
> registration that works this way.

I think the key point to this bug was to see if there is a way to indicate that the patron has already registered.

I will rework the title of this bug.

I wonder if maybe in the online registration process the patron could be asked if they already have a library card number, then ask for it, verify that the account still exists, and then redirect them to contact their library rather than complete a request online that is not needed.
Comment 4 David Cook 2024-01-09 23:53:26 UTC
(In reply to Christopher Brannon from comment #0)
> I think it would be good, if online registration noted that an account with
> the e-mail address a patron is registering with is already in use.

I'm pretty sure this is already possible using the system preference "PatronSelfRegistrationEmailMustBeUnique".

Of course, I think it has a shortcoming in that it only looks at borrowers.email and not all email fields.
Comment 5 Christopher Brannon 2024-01-10 00:30:48 UTC
(In reply to David Cook from comment #4)
> (In reply to Christopher Brannon from comment #0)
> > I think it would be good, if online registration noted that an account with
> > the e-mail address a patron is registering with is already in use.
> 
> I'm pretty sure this is already possible using the system preference
> "PatronSelfRegistrationEmailMustBeUnique".

No this setting is to only allow one account to have a specific email address.  What I'm trying to ask for is that the patron be asked if they already have a card, that they somehow be told that they should already have an account and not be allowed to request a new one.  Or, if they don't remember they have a card, and try to apply, and certain match points exist, that it not allow them to register online.
Comment 6 David Cook 2024-01-10 02:23:05 UTC
(In reply to Christopher Brannon from comment #5)
> (In reply to David Cook from comment #4)
> > (In reply to Christopher Brannon from comment #0)
> > > I think it would be good, if online registration noted that an account with
> > > the e-mail address a patron is registering with is already in use.
> > 
> > I'm pretty sure this is already possible using the system preference
> > "PatronSelfRegistrationEmailMustBeUnique".
> 
> No this setting is to only allow one account to have a specific email
> address.  What I'm trying to ask for is that the patron be asked if they
> already have a card, that they somehow be told that they should already have
> an account and not be allowed to request a new one.  Or, if they don't
> remember they have a card, and try to apply, and certain match points exist,
> that it not allow them to register online.

Currently, with that system preference, if they try to re-register using the same email address, it will say that they're already on the system.

Are you saying that you just want additional match points?
Comment 7 David Cook 2024-01-10 02:26:15 UTC
(In reply to Christopher Brannon from comment #3)
> I have not known a system that doesn't either say that the email address is
> already in use if you try to register under it, or at least give a generic
> error message.

Note that just because other systems do something doesn't mean that we're going to do it. I see potential security issues in so many other systems that I use routinely. 

And in the case of using additional match points, that involves capturing and storing more personal information as well, which then leads to increased risk to users in the event that there is a leak. 

But if you can articulate things a bit more clearly perhaps we can look at it a bit more.
Comment 8 Christopher Brannon 2024-01-10 19:35:44 UTC
The biggest issue I see is that we will get someone that either already has a library, or someone that doesn't, who registers two or three times.  There is nothing stopping them or letting them know they are already registered.  I don't know what match points are being looked at.