Bug 34612 - SCO module should display error message when attempting to log in with wrong username and password
Summary: SCO module should display error message when attempting to log in with wrong ...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-24 21:06 UTC by Lucas Gass
Modified: 2023-10-18 17:36 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lucas Gass 2023-08-24 21:06:20 UTC
To recreate:

1. Enable WebBasedSelfCheck
2. Have SelfCheckoutByLogin set to 'username and password'
3. Go to /cgi-bin/koha/sco/sco-main.pl and try login in with erroneous login credentials.
4. Screen flashes and the user is returned to blank login screen with no indication of what has gone wrong.
5. Switch 'SelfCheckoutByLogin' to 'cardnumber' and try an erroneous card number 
6. See the message:


Sorry

The userid X was not found in the database. Please try again.
Comment 1 Katrin Fischer 2023-08-24 21:08:07 UTC
Hm, isn't this a security issue? We should not confirm existance or non-existance of the userid?
Comment 2 Lucas Gass 2023-08-24 21:19:35 UTC
(In reply to Katrin Fischer from comment #1)
> Hm, isn't this a security issue? We should not confirm existance or
> non-existance of the userid?

You mean when 'SelfCheckoutByLogin' is set to 'cardnumber'? I can see how that is problematic. 

But when it is set to 'username and password' we should be able to display a message saying your password/username combo is incorrect, right? 

This is a usability problem for users. It's pretty confusing for users to just see a screen flash with no indication of what is going wrong.
Comment 3 Katrin Fischer 2023-08-24 21:29:57 UTC
I think we can do that - similar to the OPAC one maybe?
Comment 4 Lucas Gass 2023-08-24 22:19:18 UTC
(In reply to Katrin Fischer from comment #3)
> I think we can do that - similar to the OPAC one maybe?

+1
Comment 5 Joe Salamon 2023-10-18 17:36:20 UTC
The functionality Cuyahoga is seeking would be very basic to mitigate privacy or security concerns. After submitting invalid barcode-username and/or PIN-password info on the SCO login screen only, the software would return a generic text display similar to: "Login information is not valid. Please try again."