When a user tries to much login attempts, they are blocked. There are two ways to unlock the user: 1 - Change the database 2 - Reset the password There is currently no option to simply remove the lock for a blocked account. In BZ 25947 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947) we added a button to reset the password and another to simply reset the loginattempts. This bug has been created to split the two improvements. This bugs containts the improvements related to the button to reset loginattempts
Created attachment 169845 [details] [review] Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Change system preference 'FailedLoginAttempts' to a small number, like 2 2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 3. In the OPAC, try to log in with the username and a wrong password 3 times 4. Go back to the patron's account in the staff interface 5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 6. Click on "Reset login attempts", page reloads and you see patron is unlocked
Created attachment 169846 [details] [review] Bug 37512: (QA follow-up) Fix filter
kohadev-koha@kohadevbox:koha(bug_37512)$ git bz apply 37512 Bug 37512 - Add a function to reset login attempts 169845 - Bug 37512: Add a function to reset login attempts 169846 - Bug 37512: (QA follow-up) Fix filter Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 37512: Add a function to reset login attempts error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc). error: could not build fake ancestor Patch failed at 0001 Bug 37512: Add a function to reset login attempts
Oh I did not mention in the test plan to apply BZ25947, I add it
Created attachment 169854 [details] [review] Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on "Reset login attempts", page reloads and you see patron is unlocked
Created attachment 169865 [details] [review] Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on "Reset login attempts", page reloads and you see patron is unlocked Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc).
Created attachment 176958 [details] [review] Bug 37512: Add a button to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Rebased on main. Note - also changed title: there is no new function
Double-check, there is something wrong: https://snipboard.io/S7Rt46.jpg
Created attachment 177061 [details] [review] Bug 37512: Add a button to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Note: Qa tool says there is one more messy line but I could not figure out why
I think we should add the same icon (fa-info-circle) with the tooltip then the "reset password" link. Also we confirmation box would be nice.
Created attachment 179433 [details] [review] Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times 5. Go back to the patron's account in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Created attachment 179470 [details] [review] Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing) 5. Go back to the patron's account details in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on the button to reset the login attempts. 8. There is a modal, click on confirm 9. Notice you have been redirected to the account details page. 10. Notice there is no message anymore, notice you can log in again. 11. Repeat 4-9 using the checkout page, notice you are redirected to the checkout page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Created attachment 179471 [details] [review] Bug 37512: (follow-up) Add a modal Note: this also fix the CSRF issue on this patch since 24.11
Not sure in the test plan when i should apply the patches.
(In reply to Thibault Keromnès from comment #17) > Not sure in the test plan when i should apply the patches. Right at the beginning. Note: I just published a rebase for the dependency patch
Better to edit the test plan in the patch. For the clarification not be lost if another signoff roundtrip is needed and someone else attempts it. And for QA to not risk being confused by the same thing if missing the comment.
Created attachment 179829 [details] [review] Bug 37512: Add a function to reset login attempts When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC. This patch adds, like for "Patron's card has expired" message : * a link to reset login attempts to 0 Link is only displayed if libarian has permission to edit patrons. Reset login attempts to 0 feature uses members/setstatus.pl with resetloginattempts=y like reregistration=y for an expired patron To test: 1. Apply BZ25947, apply this patch 2. Change system preference 'FailedLoginAttempts' to a small number, like 2 3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too) 4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing) 5. Go back to the patron's account details in the staff interface 6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)" 7. Click on the button to reset the login attempts. 8. There is a modal, click on confirm 9. Notice you have been redirected to the account details page. 10. Notice there is no message anymore, notice you can log in again. 11. Repeat 4-9 using the checkout page, notice you are redirected to the checkout page Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Created attachment 179830 [details] [review] Bug 37512: (follow-up) Add a modal Note: this also fix the CSRF issue on this patch since 24.11