Two thoughts: Is there a reason patrons have to be presented with two fields, one for login or one for e-mail address? The prompt says to enter one or the other. Since there is the possibility for more than one account to have the same e-mail address, should we only ask for the username? The second thought is, should Koha e-mail the account user if a request has been made to reset the password? This seems to be common practice these days.
I think the idea is that the user can pick what they know/have on hand, which varies with different use cases. The email AND the login are only required if there are users with the same email address. I think often it's easier for users to give their institutional email than a cardnumber/userid. For your second question I am not sure: the user is always emailed in this process?
Oh, yeah! I'm having problems with ideas, apparently. Of course they already get an e-mail. As far as the two lines go, I guess perhaps it should be reworded, or maybe guided? Even though it says to enter either, it looks like you should enter both. Maybe it should start with picking one, then prompting for the info. Then if it needs more (in the case of the e-mail address being detected on more than one account) it should ask for a username. That might make it a little more clear. It just seems if you present patrons with an option to use either, and then go for the e-mail, and they actually need both, then they are going to get frustrated or give up.
I like the idea of making the 'pick one' more obvious. I am rewording the description a little to make that stand out.
Thanks for helping me work this out, and listening. Sometimes it isn't easy to put a finger on, and I have to think a little more about what is going on. :)
My pleasure - I have no problem throwing ideas around and love learning about use cases (hence often asking a lot of questions I guess)
Created attachment 134654 [details] An idea
That looks very nice!
Agreed! How do we handle the case with multiple users having the same email? (it will ask for username then)
+1 We are sometimes having zealous patrons filling out both fields (when not necessary) and failing to set their password. It would be nice to have this changed to something like what Owen created.
Created attachment 167642 [details] [review] Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out This patch updates the OPAC's forgotten password form so that the form fields are initially hidden. The user clicks on "I know my login" or "I know my email address" to display the relevant form field. To test, apply the patch and go to Administration to make sure the "OpacResetPassword" preference is enabled. - In the OPAC, click the "Forgot your password?" link on the home page. - Test the two buttons, "I know my login" and "I know my email address." Each should display the correct parts of the form. - Try submitting an email address which has been set to more than one patron. - You should get an error message, "Account identification with this email address only is ambiguous." - Both form fields should be visible. Sponsored-By: Athens County Public Libraries
Created attachment 167675 [details] [review] Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out This patch updates the OPAC's forgotten password form so that the form fields are initially hidden. The user clicks on "I know my login" or "I know my email address" to display the relevant form field. To test, apply the patch and go to Administration to make sure the "OpacResetPassword" preference is enabled. - In the OPAC, click the "Forgot your password?" link on the home page. - Test the two buttons, "I know my login" and "I know my email address." Each should display the correct parts of the form. - Try submitting an email address which has been set to more than one patron. - You should get an error message, "Account identification with this email address only is ambiguous." - Both form fields should be visible. Sponsored-By: Athens County Public Libraries Signed-off-by: Sam Lau <samalau@gmail.com>
I love the button additions! There's just one small issue. In step 3, when you get the following error: "Account identification with this email address only is ambiguous. Please use the field 'Login' as well." It contradicts the "To reset your password, enter your login or your email address." which is still visible. We should remove this message if the new error pops up.
Created attachment 170146 [details] [review] Bug 30088: (follow-up) Improve behavior when email is ambiguous This patch makes a few changes to the way the form appears when you submit an email which is attached to more than one patron account. Apply the patch and rebuild the OPAC CSS. - If you submit an email address which isn't unique, the "enter your login or your email address" message is hidden. - The login and email fields are marked as required. This patch also changes the behavior of the "I know my..." buttons so that they change style when clicked.
Created attachment 171802 [details] [review] Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out This patch updates the OPAC's forgotten password form so that the form fields are initially hidden. The user clicks on "I know my login" or "I know my email address" to display the relevant form field. To test, apply the patch and go to Administration to make sure the "OpacResetPassword" preference is enabled. - In the OPAC, click the "Forgot your password?" link on the home page. - Test the two buttons, "I know my login" and "I know my email address." Each should display the correct parts of the form. - Try submitting an email address which has been set to more than one patron. - You should get an error message, "Account identification with this email address only is ambiguous." - Both form fields should be visible. Sponsored-By: Athens County Public Libraries Signed-off-by: Sam Lau <samalau@gmail.com> Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Created attachment 171803 [details] [review] Bug 30088: (follow-up) Improve behavior when email is ambiguous This patch makes a few changes to the way the form appears when you submit an email which is attached to more than one patron account. Apply the patch and rebuild the OPAC CSS. - If you submit an email address which isn't unique, the "enter your login or your email address" message is hidden. - The login and email fields are marked as required. This patch also changes the behavior of the "I know my..." buttons so that they change style when clicked. Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
QA tool was happy and everything looks good. Passing QA here. Thanks, Owen!
I have no luck testing this :( 1) I have set up 2 accounts with the same email address and try to reset my password using the email. I get: An error occurred while sending you the password recovery link. Please try again later. Could you please run through this again and double check? 2) I feel that the text on the buttons is maybe a little bit on the big side compared to the fonts on the rest of the page. yarn build has been run.
I don't want to be a party-pooper, but we are contemplating to file a bug for making both email and userID mandatory The background for this: There has been a series of frauds in Sweden where the impostors have used the password recovery feature to deceive elderly people (80+ years) All swedish libraries use the equivalent to social security numbers as userID. The impostors have somehow got a list of social security numbers, and enters them one after another in password recovery. When they see that an email is sent they call the patron, saying they are calling form the library and wants to help them with their password-problem The patron gets confused and is asked to open his/her electronicID - and if they do the impostors use it to transfer money from their bank-account. One patron in a suburb to Stockholm lost 40000€ this way. Therefore we think it's too easy to recover passwords in the opac. By making both email and userID mandatory frauds like this will be next to impossible
(In reply to Klas Blomberg from comment #18) > I don't want to be a party-pooper, but we are contemplating to file a bug > for making both email and userID mandatory > > The background for this: > There has been a series of frauds in Sweden where the impostors have used > the password recovery feature to deceive elderly people (80+ years) > > All swedish libraries use the equivalent to social security numbers as > userID. > The impostors have somehow got a list of social security numbers, and enters > them one after another in password recovery. > When they see that an email is sent they call the patron, saying they are > calling form the library and wants to help them with their password-problem > The patron gets confused and is asked to open his/her electronicID - and if > they do the impostors use it to transfer money from their bank-account. > One patron in a suburb to Stockholm lost 40000€ this way. Therefore we think > it's too easy to recover passwords in the opac. > > By making both email and userID mandatory frauds like this will be next to > impossible Hi Klas, that's a real bad story. I am sorry to hear. I think requiring userid (with it accepting either cardnumber or username) + email would be OK for us. With your argument I am not sure if it needs to be configurable.
I think this is also a good argument for NOT giving any indication whether a particular user id has been found. In my experience on other web sites the user would get a message like "If you have an account you will get an email."
This may be something that needs to be addressed in another bug, but what about patrons that don't use email? Shouldn't there be a process for SMS as well?
(In reply to Christopher Brannon from comment #21) > what about patrons that don't use email? Shouldn't there > be a process for SMS as well? That would also be a separate bug.