View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons/Password.pm (-29 / +21 lines)
Lines 91-124 sub set_public { Link Here
91
91
92
    my $user = $c->stash('koha.user');
92
    my $user = $c->stash('koha.user');
93
93
94
    unless ( $user->borrowernumber == $patron_id ) {
94
    return try {
95
        return $c->render(
95
        $c->auth->public($patron_id);
96
            status  => 403,
97
            openapi => {
98
                error => "Changing other patron's password is forbidden"
99
            }
100
        );
101
    }
102
96
103
    unless ( $user->category->effective_change_password ) {
97
        unless ( $user->category->effective_change_password ) {
104
        return $c->render(
98
            return $c->render(
105
            status  => 403,
99
                status  => 403,
106
            openapi => {
100
                openapi => { error => "Changing password is forbidden" }
107
                error => "Changing password is forbidden"
101
            );
108
            }
102
        }
109
        );
110
    }
111
103
112
    my $old_password = $body->{old_password};
104
        my $old_password = $body->{old_password};
113
    my $password     = $body->{password};
105
        my $password     = $body->{password};
114
    my $password_2   = $body->{password_repeated};
106
        my $password_2   = $body->{password_repeated};
115
107
116
    unless ( $password eq $password_2 ) {
108
        unless ( $password eq $password_2 ) {
117
        return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
109
            return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
118
    }
110
        }
119
111
120
    return try {
112
        unless ( checkpw_internal( $user->userid, $old_password ) ) {
121
        unless ( checkpw_internal($user->userid, $old_password ) ) {
122
            return $c->render(
113
            return $c->render(
123
                status  => 400,
114
                status  => 400,
124
                openapi => { error => "Invalid password" }
115
                openapi => { error => "Invalid password" }
Lines 126-144 sub set_public { Link Here
126
        }
117
        }
127
118
128
        ## Change password
119
        ## Change password
129
        $user->set_password({ password => $password });
120
        $user->set_password( { password => $password } );
130
121
131
        return $c->render( status => 200, openapi => "" );
122
        return $c->render( status => 200, openapi => "" );
132
    }
123
    } catch {
133
    catch {
134
        if ( blessed $_ and $_->isa('Koha::Exceptions::Password') ) {
124
        if ( blessed $_ and $_->isa('Koha::Exceptions::Password') ) {
135
            return $c->render(
125
            return $c->render(
136
                status  => 400,
126
                status  => 400,
137
                openapi => { error => "$_" }
127
                openapi => { error => "$_" }
138
            );
128
            );
129
        } elsif ( blessed $_ and $_->isa('Koha::Exceptions::REST::Public::Unauthorized') ) {
130
            return $c->render( status => 403, json => { error => "Changing other patron's password is forbidden" } );
131
        } else {
132
            $c->unhandled_exception($_);
139
        }
133
        }
140
141
        $c->unhandled_exception($_);
142
    };
134
    };
143
}
135
}
144
136
(-)a/api/v1/swagger/paths/public_patrons.yaml (-2 lines)
Lines 60-67 Link Here
60
        description: Under maintenance
60
        description: Under maintenance
61
        schema:
61
        schema:
62
          $ref: "../swagger.yaml#/definitions/error"
62
          $ref: "../swagger.yaml#/definitions/error"
63
    x-koha-authorization:
64
      allow-owner: true
65
"/public/patrons/{patron_id}/checkouts":
63
"/public/patrons/{patron_id}/checkouts":
66
  post:
64
  post:
67
    x-mojo-to: Checkouts#add
65
    x-mojo-to: Checkouts#add
(-)a/t/db_dependent/api/v1/patrons_password.t (-3 / +14 lines)
Lines 117-123 subtest 'set() (authorized user tests)' => sub { Link Here
117
117
118
subtest 'set_public() (unprivileged user tests)' => sub {
118
subtest 'set_public() (unprivileged user tests)' => sub {
119
119
120
    plan tests => 18;
120
    plan tests => 21;
121
121
122
    $schema->storage->txn_begin;
122
    $schema->storage->txn_begin;
123
123
Lines 162-167 subtest 'set_public() (unprivileged user tests)' => sub { Link Here
162
        }
162
        }
163
    );
163
    );
164
164
165
    $t->post_ok(
166
        "/api/v1/public/patrons/" . $patron->id . "/password" => json => {
167
            password          => $new_password,
168
            password_repeated => $new_password,
169
            old_password      => $password
170
        }
171
    )->status_is(401)->json_is(
172
        '/error',
173
        "Authentication failure."
174
    );
175
176
165
    t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
177
    t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
166
178
167
    $t->post_ok(
179
    $t->post_ok(
Lines 174-180 subtest 'set_public() (unprivileged user tests)' => sub { Link Here
174
          }
186
          }
175
    )->status_is(403)
187
    )->status_is(403)
176
      ->json_is( '/error',
188
      ->json_is( '/error',
177
        "Authorization failure. Missing required permission(s)." );
189
        "Changing other patron's password is forbidden" );
178
190
179
    $t->post_ok(
191
    $t->post_ok(
180
            "//$userid:$password@/api/v1/public/patrons/"
192
            "//$userid:$password@/api/v1/public/patrons/"
181
- 

Return to bug 28907