To recreate: 1. Enable WebBasedSelfCheck 2. Have SelfCheckoutByLogin set to 'username and password' 3. Go to /cgi-bin/koha/sco/sco-main.pl and try login in with erroneous login credentials. 4. Screen flashes and the user is returned to blank login screen with no indication of what has gone wrong. 5. Switch 'SelfCheckoutByLogin' to 'cardnumber' and try an erroneous card number 6. See the message: Sorry The userid X was not found in the database. Please try again.
Hm, isn't this a security issue? We should not confirm existance or non-existance of the userid?
(In reply to Katrin Fischer from comment #1) > Hm, isn't this a security issue? We should not confirm existance or > non-existance of the userid? You mean when 'SelfCheckoutByLogin' is set to 'cardnumber'? I can see how that is problematic. But when it is set to 'username and password' we should be able to display a message saying your password/username combo is incorrect, right? This is a usability problem for users. It's pretty confusing for users to just see a screen flash with no indication of what is going wrong.
I think we can do that - similar to the OPAC one maybe?
(In reply to Katrin Fischer from comment #3) > I think we can do that - similar to the OPAC one maybe? +1
The functionality Cuyahoga is seeking would be very basic to mitigate privacy or security concerns. After submitting invalid barcode-username and/or PIN-password info on the SCO login screen only, the software would return a generic text display similar to: "Login information is not valid. Please try again."