Bug 30240 - Re-authentication on sensitive actions
Summary: Re-authentication on sensitive actions
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-03-07 11:31 UTC by Magnus Enger
Modified: 2022-03-09 17:02 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2022-03-07 11:31:13 UTC
It would be nice if it was possible to give extra protection to some sensitive actions in the staff client, such as maybe updating borrowers and definitely changing sysprefs. This could be done by asking the user to re-authenticate, before carrying out the action. Extra nice if this could be turned on and off for individual actions. 

https://opsec.readthedocs.io/en/latest/user/re-authentication-on-sensitive-actions.html
Comment 1 Lisette Scheer 2022-03-09 17:02:33 UTC
(In reply to Magnus Enger from comment #0)
> It would be nice if it was possible to give extra protection to some
> sensitive actions in the staff client, such as maybe updating borrowers and
> definitely changing sysprefs. This could be done by asking the user to
> re-authenticate, before carrying out the action. Extra nice if this could be
> turned on and off for individual actions. 
> 
> https://opsec.readthedocs.io/en/latest/user/re-authentication-on-sensitive-
> actions.html

I like this for sys prefs at least. I think it could be very time consuming if circ staff had to re-enter passwords every time we edited a patron, which happens very frequently. Although for changing prefs/changing to staff patron type. 

Additional places it might be good:
Delete all items
Batch patron deletion
Batch record deletion.