The anonymous patron is not allowed to checkout through the staff module, but it appears that you can login as this user on the self check and check out items. While it is more likely this could be exploited with a random library card number, this does create a hole in blocking circ on this account.
This also seems to be the case with SIP transactions. I've restricted the anonymous account.
1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! I would HIGHLY suggest preventing the account from using anonymous as the cardnumber/username. Koha should also block this patron from checking out, just like it does in the staff interface. Maybe it should just be automatically restricted account indefinitely?
Created attachment 165487 [details] [review] Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.
(In reply to Christopher Brannon from comment #1) > This also seems to be the case with SIP transactions. > > I've restricted the anonymous account. Christopher, Can you file a separate bug outlining how you were able to do this via a SIP transaction? Thanks!
This blocks the AnonymousPatron from logging in at the SCO module. Is there any reason that the AnonymousPatron should be able to log into anything? ( OPAC/SCO/Staff ) Maybe we should block this at Auth.pm?
(In reply to Lucas Gass from comment #4) > (In reply to Christopher Brannon from comment #1) > > This also seems to be the case with SIP transactions. > > > > I've restricted the anonymous account. > > Christopher, > > Can you file a separate bug outlining how you were able to do this via a SIP > transaction? > > Thanks! https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36695
Created attachment 166025 [details] [review] Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'. Signed-off-by: David Nind <david@davidnind.com>
Testing notes using KTD: 1. Step 5: [hostname]/cgi-bin/koha/sco/sco-main.pl 2. Step 8: While the URL is /cgi-bin/koha/opac-main.pl, the page has the log in form in the middle and none of the normal header (including the OPAC search box).
Created attachment 167392 [details] [review] Bug 36679: Prevent SCO login for the AnonymousPatron 1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use. 2. Make sure AnonymousPatron is pointed to an account. 3. Set SelfCheckoutByLogin to cardnumber. 4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items. 5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user. 6. Proceed to check out items! 7. APPLY PATCH, restart_all 8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page 9. Switch SelfCheckoutByLogin to 'username and pasword'. 10. Again try to log in as the AnonymousPatron, you should not be able to. 11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Nice simple fix, passing QA
Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant
Backported to 24.05.x for upcoming 24.05.02
Cool. We should consider creating Koha::Patron->is_anonymous()
Pushed to 23.11.x for 23.11.07
not backporting to 23.05.x unless requested