Attachment #126814 for bug #29272

View | Details | Raw Unified | Return to bug 29272
Collapse All | Expand All




    my $body      = $c->validation->param('body');
    my $patron_id = $c->validation->param('patron_id');

    # short-circuit early
    unless ( C4::Context->preference('OpacPasswordChange') ) {
        return $c->render(
            status  => 403,
            openapi => { error => "Configuration prevents password changes by unprivileged users" }
        );
    }

    my $user = $c->stash('koha.user');

    unless ( $user->borrowernumber == $patron_id ) {

Lines 158-165 subtest 'set_public() (unprivileged user tests)' => sub { Link Here

(-)a/t/db_dependent/api/v1/patrons_password.t (-3 / +1 lines)
158	}	158	}
159	)->status_is(403)->json_is(	159	)->status_is(403)->json_is(
160	{	160	{
161	error =>	161	error => 'Changing password is forbidden'
162	'Configuration prevents password changes by unprivileged users'
163	}	162	}
164	);	163	);
165		164
166	-

Return to bug 29272

Lines 90-103 sub set_public { Link Here

(-)a/Koha/REST/V1/Patrons/Password.pm (-8 lines)
90	my $body = $c->validation->param('body');	90	my $body = $c->validation->param('body');
91	my $patron_id = $c->validation->param('patron_id');	91	my $patron_id = $c->validation->param('patron_id');
92		92
93	# short-circuit early
94	unless ( C4::Context->preference('OpacPasswordChange') ) {
95	return $c->render(
96	status => 403,
97	openapi => { error => "Configuration prevents password changes by unprivileged users" }
98	);
99	}
100
101	my $user = $c->stash('koha.user');	93	my $user = $c->stash('koha.user');
102		94
103	unless ( $user->borrowernumber == $patron_id ) {	95	unless ( $user->borrowernumber == $patron_id ) {