https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43896
Bug ID: 43896
Summary: Patrons can't log in with a cardnumber that matches
another patron's userid
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
Since bug 40286, checkpw_internal only checks the password of the patron whose
userid matches the login. If that string is also another patron's cardnumber,
the cardnumber owner can no longer log in with their own password. Before 26.05
Koha fell back to the cardnumber match, so logins that worked for years break
on upgrade. Each failed attempt also increments login_attempts on the userid
owner.
This affects everything that goes through C4::Auth::checkpw
To recreate:
1) Create patron A with cardnumber TESTCARD and a password
2) Create patron B with userid TESTCARD and a different password
3) Log into the OPAC as TESTCARD with patron A's password
4) Note "You entered an incorrect username or password"
5) Note patron B's login_attempts went up
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
