To recreate: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. The only thing that solves it for me is to direct my browser to this URL: http://localhost:8080/cgi-bin/koha/sco/sco-main.pl?op=logout That properly logs me out and allows me to input a new cardnumber.
Created attachment 131348 [details] [review] Bug 30199: self checkout login by cardnumber is broken if you input a non-existent cardnumber Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber!
Created attachment 131364 [details] [review] Bug 30199: self checkout login by cardnumber is broken if you input a non-existent cardnumber Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
As this is the area we just had the security fixes for, we might want to verify if this is related (I suspect it is) to make sure it gets backported to all the right versions. I am updating the severity as for a standalone self check station this could be quite an issue with no staff around to restart things.
Created attachment 131860 [details] [review] Bug 30199: [ALTERNATIVE-PATH] Do not generate jtw if patron does not exist
Good catch, Kyle! Can you have a look at this alternative patch please? I think the correct fix is to not generate the JWT if the patron's info are not valid.
Certainly caused by bug 29543.
Lucas, Kyle, could you test this alternative patch?
Created attachment 131973 [details] [review] Bug 30199: Do not generate jtw if patron does not exist Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan, Your patch works nicely so I signed off and obsoleted Kyle's.
Created attachment 131978 [details] [review] Bug 30199: Do not generate jwt if patron does not exist This is a follow-up patch for bug 29543. If an invalid cardnumber has been used we should not generate a token. Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(In reply to Lucas Gass from comment #9) > Jonathan, > > Your patch works nicely so I signed off and obsoleted Kyle's. Thanks!
Created attachment 132183 [details] [review] Bug 30199: Do not generate jwt if patron does not exist This is a follow-up patch for bug 29543. If an invalid cardnumber has been used we should not generate a token. Test Plan: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. Apply this patch 7. Restart all the things! 8. Repeat steps 2-4 9. Try again with a different cardnumber, you should now see the correct cardnumber! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Nice simple fix, works as expected PQA
Pushed to master for 22.05, thanks to everybody involved [U+1F984]
If possible can we get this backported to 21.11 and 21.05?
(In reply to Lucas Gass from comment #15) > If possible can we get this backported to 21.11 and 21.05? Yes, looks like it should be backported into all stables.
We'd love to have this backported to 21.05 as soon as possible. It's starting to show up on machines that were previously well-behaved. Thanks!
Pushed to 21.11.x for 21.11.05
Pushed to 21.05.x for 21.05.15
Backported: Pushed to 20.11.x branch for 20.11.19
Does this need to be backported to 19.11.x?