From 931df45d87226d48357997f46b0075f83b58d80f Mon Sep 17 00:00:00 2001 From: Aleisha Amohia Date: Fri, 6 May 2022 02:04:35 +0000 Subject: [PATCH] Bug 30700: Allow staff users to change their password via staff client Patrons who can log into the staff client (have the 'catalogue' permission) should be able to change their own password. To test: 0) Apply the patch, install database updates, restart services. Go to System preferences and enable the StaffLoginResetPassword system preference. 1) Create a user with only 'catalogue' permissions (Patron A) 2) Log in to the staff client as Patron A 3) Click the menu with your username in the top-right of the window. Click the 'your account' menu link. 4) Confirm you are forced to a login screen, so you cannot view your account, which is where the 'change password' link is normally found. 5) Try to access the page to change your password directly http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X (swap Patron A's borrowernumber in). Confirm you are forced to a login screen. 6) Apply this patch and restart services. Go back to the mainpage logged in as Patron A. 7) Click the menu with your username in the top-right of the window. Notice there is now a 'Change password' menu link. Go to 'change password'. 8) Confirm you are now shown a page to change your password. Change your password, and confirm you are redirect to the mainpage. 9) Try to access the page to change someone else's page directly http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X (swap some other borrowernumber in). Confirm you are redirected to a 404. 10) Log out and log back in as your original borrower. Confirm you are able to change your password as normal. Sponsored-by: Education Services Australia SCIS Signed-off-by: David Nind Signed-off-by: Sam Lau --- .../intranet-tmpl/prog/en/includes/header.inc | 5 +++++ .../prog/en/includes/members-toolbar.inc | 4 +++- members/member-password.pl | 18 +++++++++++++++--- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc index a63e8443c7..8a8ad834d4 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc @@ -200,6 +200,11 @@ My checkouts [% END %] + + +
  • Log out
  • diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc index 068198fbe7..2d5e472f1f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -13,9 +13,11 @@ [% IF patron.is_adult AND Koha.Preference("borrowerRelationship") %] Add guarantee [% END %] - Change password Duplicate [% END %] + [% IF CAN_user_borrowers_edit_borrowers || patron.borrowernumber == logged_in_user.borrowernumber %] + Change password + [% END %] [% IF CAN_user_circulate_circulate_remaining_permissions %]
    diff --git a/members/member-password.pl b/members/member-password.pl index d44f29d0f7..40adcfb0fc 100755 --- a/members/member-password.pl +++ b/members/member-password.pl @@ -28,11 +28,19 @@ my ( $template, $loggedinuser, $cookie, $staffflags ) = get_template_and_user( template_name => "members/member-password.tt", query => $input, type => "intranet", - flagsrequired => { borrowers => 'edit_borrowers' }, + flagsrequired => { catalogue => 1 }, } ); my $patron_id = $input->param('member'); +my $logged_in_user = Koha::Patrons->find( $loggedinuser ); + +if ( !$logged_in_user->has_permission({ borrowers => 'edit_borrowers' }) and $loggedinuser != $patron_id ) { + print $input->redirect("/cgi-bin/koha/errors/404.pl"); + +} else { +# patron has permission to edit other borrowers, or is changing their own password + my $destination = $input->param('destination'); my $newpassword = $input->param('newpassword'); my $newpassword2 = $input->param('newpassword2'); @@ -40,7 +48,6 @@ my $new_user_id = $input->param('newuserid'); my @errors; -my $logged_in_user = Koha::Patrons->find( $loggedinuser ); my $patron = Koha::Patrons->find( $patron_id ); output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); @@ -68,7 +75,10 @@ if ( $newpassword and not @errors) { $patron->userid($new_user_id)->store if $new_user_id and $new_user_id ne $patron->userid; $template->param( newpassword => $newpassword ); - if ( $destination eq 'circ' ) { + if ( !$patron->has_permission({ borrowers => 'edit_borrowers' }) ) { + print $input->redirect("/cgi-bin/koha/mainpage.pl"); + } + elsif ( $destination eq 'circ' ) { print $input->redirect("/cgi-bin/koha/circ/circulation.pl?findborrower=" . $patron->cardnumber); } else { @@ -107,4 +117,6 @@ if ( scalar(@errors) ) { } } +} # patron has permission to edit other borrowers, or is changing their own password + output_html_with_http_headers $input, $cookie, $template->output; -- 2.30.2