Bug 37512 - Add a function to reset login attempts
Summary: Add a function to reset login attempts
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Baptiste Wojtkowski (bwoj)
QA Contact: Testopia
URL:
Keywords:
Depends on: 25947
Blocks:
  Show dependency treegraph
 
Reported: 2024-07-29 14:23 UTC by Baptiste Wojtkowski (bwoj)
Modified: 2025-03-28 09:45 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 37512: Add a function to reset login attempts (3.10 KB, patch)
2024-07-29 15:15 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: (QA follow-up) Fix filter (1.41 KB, patch)
2024-07-29 15:15 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: Add a function to reset login attempts (3.12 KB, patch)
2024-07-30 08:47 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: Add a function to reset login attempts (3.18 KB, patch)
2024-07-30 14:13 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 37512: Add a button to reset login attempts (3.19 KB, patch)
2025-01-23 14:00 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: Add a button to reset login attempts (3.18 KB, patch)
2025-01-23 15:03 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: Add a function to reset login attempts (31.63 KB, patch)
2025-03-18 10:32 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: Add a function to reset login attempts (30.76 KB, patch)
2025-03-19 10:45 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: (follow-up) Add a modal (32.10 KB, patch)
2025-03-19 10:45 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: Add a function to reset login attempts (30.78 KB, patch)
2025-03-28 09:44 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 37512: (follow-up) Add a modal (32.10 KB, patch)
2025-03-28 09:44 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Baptiste Wojtkowski (bwoj) 2024-07-29 14:23:52 UTC
When a user tries to much login attempts, they are blocked.
There are two ways to unlock the user:
1 - Change the database
2 - Reset the password

There is currently no option to simply remove the lock for a blocked account. In BZ 25947 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947) we added a button to reset the password and another to simply reset the loginattempts.

This bug has been created to split the two improvements. This bugs containts the improvements related to the button to reset loginattempts
Comment 1 Baptiste Wojtkowski (bwoj) 2024-07-29 15:15:30 UTC
Created attachment 169845 [details] [review]
Bug 37512: Add a function to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Change system preference 'FailedLoginAttempts' to a small number, like 2
2. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
3. In the OPAC, try to log in with the username and a wrong password 3 times
4. Go back to the patron's account in the staff interface
5. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
6. Click on "Reset login attempts", page reloads and you see patron is unlocked
Comment 2 Baptiste Wojtkowski (bwoj) 2024-07-29 15:15:33 UTC
Created attachment 169846 [details] [review]
Bug 37512: (QA follow-up) Fix filter
Comment 3 Roman Dolny 2024-07-29 17:03:31 UTC
kohadev-koha@kohadevbox:koha(bug_37512)$ git bz apply 37512

Bug 37512 - Add a function to reset login attempts

169845 - Bug 37512: Add a function to reset login attempts
169846 - Bug 37512: (QA follow-up) Fix filter

Apply? [(y)es, (n)o, (i)nteractive] y
Applying: Bug 37512: Add a function to reset login attempts
error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc).
error: could not build fake ancestor
Patch failed at 0001 Bug 37512: Add a function to reset login attempts
Comment 4 Baptiste Wojtkowski (bwoj) 2024-07-30 08:45:57 UTC
Oh I did not mention in the test plan to apply BZ25947, I add it
Comment 5 Baptiste Wojtkowski (bwoj) 2024-07-30 08:47:08 UTC
Created attachment 169854 [details] [review]
Bug 37512: Add a function to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times
5. Go back to the patron's account in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
7. Click on "Reset login attempts", page reloads and you see patron is unlocked
Comment 6 Roman Dolny 2024-07-30 14:13:36 UTC
Created attachment 169865 [details] [review]
Bug 37512: Add a function to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times
5. Go back to the patron's account in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
7. Click on "Reset login attempts", page reloads and you see patron is unlocked

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 7 Jonathan Druart 2025-01-23 13:19:06 UTC
error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc).
Comment 8 Baptiste Wojtkowski (bwoj) 2025-01-23 14:00:51 UTC
Created attachment 176958 [details] [review]
Bug 37512: Add a button to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times
5. Go back to the patron's account in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 9 Baptiste Wojtkowski (bwoj) 2025-01-23 14:02:20 UTC
Rebased on main.
Note - also changed title: there is no new function
Comment 10 Jonathan Druart 2025-01-23 14:18:03 UTC
Double-check, there is something wrong: https://snipboard.io/S7Rt46.jpg
Comment 11 Baptiste Wojtkowski (bwoj) 2025-01-23 15:03:16 UTC
Created attachment 177061 [details] [review]
Bug 37512: Add a button to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times
5. Go back to the patron's account in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 12 Baptiste Wojtkowski (bwoj) 2025-01-23 15:04:22 UTC
Note:
Qa tool says there is one more messy line but I could not figure out why
Comment 13 Jonathan Druart 2025-01-23 15:25:30 UTC
I think we should add the same icon (fa-info-circle) with the tooltip then the "reset password" link.

Also we confirmation box would be nice.
Comment 14 Baptiste Wojtkowski (bwoj) 2025-03-18 10:32:15 UTC
Created attachment 179433 [details] [review]
Bug 37512: Add a function to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times
5. Go back to the patron's account in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 15 Baptiste Wojtkowski (bwoj) 2025-03-19 10:45:38 UTC
Created attachment 179470 [details] [review]
Bug 37512: Add a function to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing)
5. Go back to the patron's account details in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
7. Click on the button to reset the login attempts.
8. There is a modal, click on confirm
9. Notice you have been redirected to the account details page.
10. Notice there is no message anymore, notice you can log in again.
11. Repeat 4-9 using the checkout page, notice you are redirected to
    the checkout page

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 16 Baptiste Wojtkowski (bwoj) 2025-03-19 10:45:42 UTC
Created attachment 179471 [details] [review]
Bug 37512: (follow-up) Add a modal

Note: this also fix the CSRF issue on this patch since 24.11
Comment 17 Thibault Keromnès 2025-03-19 14:36:16 UTC
Not sure in the test plan when i should apply the patches.
Comment 18 Baptiste Wojtkowski (bwoj) 2025-03-19 15:46:40 UTC
(In reply to Thibault Keromnès from comment #17)
> Not sure in the test plan when i should apply the patches.

Right at the beginning.
Note: I just published a rebase for the dependency patch
Comment 19 Victor Grousset/tuxayo 2025-03-28 04:12:23 UTC
Better to edit the test plan in the patch. For the clarification not be lost if another signoff roundtrip is needed and someone else attempts it.
And for QA to not risk being confused by the same thing if missing the comment.
Comment 20 Baptiste Wojtkowski (bwoj) 2025-03-28 09:44:52 UTC
Created attachment 179829 [details] [review]
Bug 37512: Add a function to reset login attempts

When using system preference 'FailedLoginAttempts', a patron's account is blocked after X many failed login attempts on the OPAC.

This patch adds, like for "Patron's card has expired" message :
  * a link to reset login attempts to 0
Link is only displayed if libarian has permission to edit patrons.

Reset login attempts to 0 feature uses members/setstatus.pl with
resetloginattempts=y like reregistration=y for an expired patron

To test:
1. Apply BZ25947, apply this patch
2. Change system preference 'FailedLoginAttempts' to a small number, like 2
3. Go to a patron's account and copy their username (while you're there, change the password and add some fines, too)
4. In the OPAC, try to log in with the username and a wrong password 3 times (you might want to use private browsing)
5. Go back to the patron's account details in the staff interface
6. Note that there is a message : "Patron's account has been locked (due to 3 failed login attempts)"
7. Click on the button to reset the login attempts.
8. There is a modal, click on confirm
9. Notice you have been redirected to the account details page.
10. Notice there is no message anymore, notice you can log in again.
11. Repeat 4-9 using the checkout page, notice you are redirected to
    the checkout page

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 21 Baptiste Wojtkowski (bwoj) 2025-03-28 09:44:56 UTC
Created attachment 179830 [details] [review]
Bug 37512: (follow-up) Add a modal

Note: this also fix the CSRF issue on this patch since 24.11