View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons/Password.pm (-21 / +18 lines)
Lines 90-118 sub set_public { Link Here
90
90
91
    my $user = $c->stash('koha.user');
91
    my $user = $c->stash('koha.user');
92
92
93
    unless ( $user->borrowernumber == $patron_id ) {
93
    return try {
94
        return $c->render(
94
        $c->auth->public($patron_id);
95
            status  => 403,
96
            openapi => { error => "Changing other patron's password is forbidden" }
97
        );
98
    }
99
95
100
    unless ( $user->category->effective_change_password ) {
96
        unless ( $user->category->effective_change_password ) {
101
        return $c->render(
97
            return $c->render(
102
            status  => 403,
98
                status  => 403,
103
            openapi => { error => "Changing password is forbidden" }
99
                openapi => { error => "Changing password is forbidden" }
104
        );
100
            );
105
    }
101
        }
106
102
107
    my $old_password = $body->{old_password};
103
        my $old_password = $body->{old_password};
108
    my $password     = $body->{password};
104
        my $password     = $body->{password};
109
    my $password_2   = $body->{password_repeated};
105
        my $password_2   = $body->{password_repeated};
110
106
111
    unless ( $password eq $password_2 ) {
107
        unless ( $password eq $password_2 ) {
112
        return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
108
            return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
113
    }
109
        }
114
110
115
    return try {
116
        unless ( checkpw_internal( $user->userid, $old_password ) ) {
111
        unless ( checkpw_internal( $user->userid, $old_password ) ) {
117
            return $c->render(
112
            return $c->render(
118
                status  => 400,
113
                status  => 400,
Lines 130-138 sub set_public { Link Here
130
                status  => 400,
125
                status  => 400,
131
                openapi => { error => "$_" }
126
                openapi => { error => "$_" }
132
            );
127
            );
128
        } elsif ( blessed $_ and $_->isa('Koha::Exceptions::REST::Public::Unauthorized') ) {
129
            return $c->render( status => 403, json => { error => "Changing other patron's password is forbidden" } );
130
        } else {
131
            $c->unhandled_exception($_);
133
        }
132
        }
134
135
        $c->unhandled_exception($_);
136
    };
133
    };
137
}
134
}
138
135
(-)a/api/v1/swagger/paths/public_patrons.yaml (-2 lines)
Lines 60-67 Link Here
60
        description: Under maintenance
60
        description: Under maintenance
61
        schema:
61
        schema:
62
          $ref: "../swagger.yaml#/definitions/error"
62
          $ref: "../swagger.yaml#/definitions/error"
63
    x-koha-authorization:
64
      allow-owner: true
65
"/public/patrons/{patron_id}/checkouts":
63
"/public/patrons/{patron_id}/checkouts":
66
  post:
64
  post:
67
    x-mojo-to: Checkouts#add
65
    x-mojo-to: Checkouts#add
(-)a/t/db_dependent/api/v1/patrons_password.t (-7 / +17 lines)
Lines 102-108 subtest 'set() (authorized user tests)' => sub { Link Here
102
102
103
subtest 'set_public() (unprivileged user tests)' => sub {
103
subtest 'set_public() (unprivileged user tests)' => sub {
104
104
105
    plan tests => 18;
105
    plan tests => 21;
106
106
107
    $schema->storage->txn_begin;
107
    $schema->storage->txn_begin;
108
108
Lines 141-159 subtest 'set_public() (unprivileged user tests)' => sub { Link Here
141
        }
141
        }
142
    )->status_is(403)->json_is( { error => 'Changing password is forbidden' } );
142
    )->status_is(403)->json_is( { error => 'Changing password is forbidden' } );
143
143
144
    t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
145
146
    $t->post_ok(
144
    $t->post_ok(
147
        "//$userid:$password@/api/v1/public/patrons/" . $other_patron->id . "/password" => json => {
145
        "/api/v1/public/patrons/" . $patron->id . "/password" => json => {
148
            password          => $new_password,
146
            password          => $new_password,
149
            password_repeated => $new_password,
147
            password_repeated => $new_password,
150
            old_password      => $password
148
            old_password      => $password
151
        }
149
        }
152
    )->status_is(403)->json_is(
150
    )->status_is(401)->json_is(
153
        '/error',
151
        '/error',
154
        "Authorization failure. Missing required permission(s)."
152
        "Authentication failure."
155
    );
153
    );
156
154
155
156
    t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
157
158
    $t->post_ok(
159
        "//$userid:$password@/api/v1/public/patrons/" . $other_patron->id . "/password" => json => {
160
            password          => $new_password,
161
            password_repeated => $new_password,
162
            old_password      => $password
163
          }
164
    )->status_is(403)
165
      ->json_is( '/error',
166
        "Changing other patron's password is forbidden" );
167
157
    $t->post_ok(
168
    $t->post_ok(
158
        "//$userid:$password@/api/v1/public/patrons/" . $patron->id . "/password" => json => {
169
        "//$userid:$password@/api/v1/public/patrons/" . $patron->id . "/password" => json => {
159
            password          => $new_password,
170
            password          => $new_password,
160
- 

Return to bug 28907