From 3fd9fb98f509b01b34047b81bab79cc32e2fcc36 Mon Sep 17 00:00:00 2001 From: Aleisha Amohia Date: Fri, 6 May 2022 02:04:35 +0000 Subject: [PATCH] Bug 30700: Allow staff users to change their password via staff client Patrons who can log into the staff client (have the 'catalogue' permission) should be able to change their own password. To test: 0) Apply the patch, install database updates, restart services. Go to System preferences and enable the StaffLoginResetPassword system preference. 1) Create a user with only 'catalogue' permissions (Patron A) 2) Log in to the staff client as Patron A 3) Click the menu with your username in the top-right of the window. Click the 'your account' menu link. 4) Confirm you are forced to a login screen, so you cannot view your account, which is where the 'change password' link is normally found. 5) Try to access the page to change your password directly http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X (swap Patron A's borrowernumber in). Confirm you are forced to a login screen. 6) Apply this patch and restart services. Go back to the mainpage logged in as Patron A. 7) Click the menu with your username in the top-right of the window. Notice there is now a 'Change password' menu link. Go to 'change password'. 8) Confirm you are now shown a page to change your password. Change your password, and confirm you are redirect to the mainpage. 9) Try to access the page to change someone else's page directly http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X (swap some other borrowernumber in). Confirm you are redirected to a 404. 10) Log out and log back in as your original borrower. Confirm you are able to change your password as normal. Sponsored-by: Education Services Australia SCIS Signed-off-by: David Nind Signed-off-by: Sam Lau Rebased-by: Victor Grousset/tuxayo Signed-off-by: Victor Grousset/tuxayo --- .../intranet-tmpl/prog/en/includes/header.inc | 6 ++++++ .../prog/en/includes/members-toolbar.inc | 4 +++- members/member-password.pl | 18 +++++++++++++++--- 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc index 0ab7ddbfdc..6820c289d9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc @@ -203,11 +203,17 @@ My checkouts [% END %] + [% IF Koha.Preference( 'CookieConsent' ) && JSConsents.all('staffConsent').size %] [% END %] + + +
  • Log out
  • diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc index 8e277919a6..82681b131d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -13,9 +13,11 @@ [% IF patron.is_adult AND Koha.Preference("borrowerRelationship") %] Add guarantee [% END %] - Change password Duplicate [% END %] + [% IF CAN_user_borrowers_edit_borrowers || patron.borrowernumber == logged_in_user.borrowernumber %] + Change password + [% END %] [% IF CAN_user_circulate_circulate_remaining_permissions %]
    diff --git a/members/member-password.pl b/members/member-password.pl index d44f29d0f7..40adcfb0fc 100755 --- a/members/member-password.pl +++ b/members/member-password.pl @@ -28,11 +28,19 @@ my ( $template, $loggedinuser, $cookie, $staffflags ) = get_template_and_user( template_name => "members/member-password.tt", query => $input, type => "intranet", - flagsrequired => { borrowers => 'edit_borrowers' }, + flagsrequired => { catalogue => 1 }, } ); my $patron_id = $input->param('member'); +my $logged_in_user = Koha::Patrons->find( $loggedinuser ); + +if ( !$logged_in_user->has_permission({ borrowers => 'edit_borrowers' }) and $loggedinuser != $patron_id ) { + print $input->redirect("/cgi-bin/koha/errors/404.pl"); + +} else { +# patron has permission to edit other borrowers, or is changing their own password + my $destination = $input->param('destination'); my $newpassword = $input->param('newpassword'); my $newpassword2 = $input->param('newpassword2'); @@ -40,7 +48,6 @@ my $new_user_id = $input->param('newuserid'); my @errors; -my $logged_in_user = Koha::Patrons->find( $loggedinuser ); my $patron = Koha::Patrons->find( $patron_id ); output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); @@ -68,7 +75,10 @@ if ( $newpassword and not @errors) { $patron->userid($new_user_id)->store if $new_user_id and $new_user_id ne $patron->userid; $template->param( newpassword => $newpassword ); - if ( $destination eq 'circ' ) { + if ( !$patron->has_permission({ borrowers => 'edit_borrowers' }) ) { + print $input->redirect("/cgi-bin/koha/mainpage.pl"); + } + elsif ( $destination eq 'circ' ) { print $input->redirect("/cgi-bin/koha/circ/circulation.pl?findborrower=" . $patron->cardnumber); } else { @@ -107,4 +117,6 @@ if ( scalar(@errors) ) { } } +} # patron has permission to edit other borrowers, or is changing their own password + output_html_with_http_headers $input, $cookie, $template->output; -- 2.42.0