Bug 36695 - anonymous patron is not blocked from checkout via SIP
Summary: anonymous patron is not blocked from checkout via SIP
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: 23.05
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-24 22:27 UTC by Christopher Brannon
Modified: 2024-04-24 22:28 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2024-04-24 22:27:35 UTC
The anonymous patron is not allowed to checkout through the staff module, but it appears that you can checkout as this user via SIP2, particularly through 3rd party self check systems that do not require the patron to enter a password.

While it is more likely this could be exploited with a random library card number, this does create a hole in blocking circ on this account.

1. Make sure AnonymousPatron is pointed to an account.
2. Point your 3rd party self check at Koha, and do not require a password for patron authentication.  (You COULD also test with a username/password scenario, which also shouldn't be allowed).
3. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
4. Sign into the 3rd party self check with the anonymous account, either as a sign in with cardnumber only, or with the username/password scenario.
5. Proceed to check out items!

Our system is setup for cardnumber only, but I imagine it works just the same with username/password.  But I can confirm that this account is checking out via SIP2.