|
Line 0
Link Here
|
| 0 |
- |
1 |
package Koha::REST::V1::Patrons::Password; |
|
|
2 |
|
| 3 |
# This file is part of Koha. |
| 4 |
# |
| 5 |
# Koha is free software; you can redistribute it and/or modify it under the |
| 6 |
# terms of the GNU General Public License as published by the Free Software |
| 7 |
# Foundation; either version 3 of the License, or (at your option) any later |
| 8 |
# version. |
| 9 |
# |
| 10 |
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY |
| 11 |
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR |
| 12 |
# A PARTICULAR PURPOSE. See the GNU General Public License for more details. |
| 13 |
# |
| 14 |
# You should have received a copy of the GNU General Public License along |
| 15 |
# with Koha; if not, write to the Free Software Foundation, Inc., |
| 16 |
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 17 |
|
| 18 |
use Modern::Perl; |
| 19 |
|
| 20 |
use Mojo::Base 'Mojolicious::Controller'; |
| 21 |
|
| 22 |
use Koha::Exceptions::Password; |
| 23 |
use Koha::Patrons; |
| 24 |
|
| 25 |
use C4::Auth qw(checkpw_internal); |
| 26 |
|
| 27 |
use Scalar::Util qw(blessed); |
| 28 |
use Try::Tiny; |
| 29 |
|
| 30 |
=head1 NAME |
| 31 |
|
| 32 |
Koha::REST::V1::Patrons::Password |
| 33 |
|
| 34 |
=head1 API |
| 35 |
|
| 36 |
=head2 Methods |
| 37 |
|
| 38 |
=head3 set |
| 39 |
|
| 40 |
Controller method that sets a patron's password |
| 41 |
|
| 42 |
=cut |
| 43 |
|
| 44 |
sub set { |
| 45 |
my $c = shift->openapi->valid_input or return; |
| 46 |
|
| 47 |
my $patron = Koha::Patrons->find( $c->validation->param('patron_id') ); |
| 48 |
my $body = $c->validation->param('body'); |
| 49 |
|
| 50 |
unless ($patron) { |
| 51 |
return $c->render( status => 404, openapi => { error => "Patron not found." } ); |
| 52 |
} |
| 53 |
|
| 54 |
return try { |
| 55 |
|
| 56 |
my $password = $body->{ password }; |
| 57 |
my $old_password = $body->{ old_password }; |
| 58 |
|
| 59 |
## Check if the patron is changing its own un-privileged account |
| 60 |
# Required permissions |
| 61 |
# TODO: Get rid of this once bug 21198 is implemented and integrated |
| 62 |
my $permissions |
| 63 |
= $c->match |
| 64 |
->endpoint |
| 65 |
->pattern |
| 66 |
->defaults |
| 67 |
->{'openapi.op_spec'} |
| 68 |
->{'x-koha-authorization'} |
| 69 |
->{'permissions'}; |
| 70 |
|
| 71 |
my $user = $c->stash('koha.user'); |
| 72 |
|
| 73 |
if ( !$user->has_permission( $permissions ) ) { |
| 74 |
# Doesn't have permissions, it reached here because it is |
| 75 |
# the user changing its own password, validate the provided password! |
| 76 |
if ( C4::Context->preference('OpacPasswordChange') ) { |
| 77 |
# self password change allowed, validate |
| 78 |
my $dbh = C4::Context->dbh; |
| 79 |
# test old_password is valid |
| 80 |
unless ( checkpw_internal($dbh, $patron->userid, $old_password ) ) { |
| 81 |
Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password"); |
| 82 |
} |
| 83 |
} |
| 84 |
else { |
| 85 |
# self password change not allowed |
| 86 |
Koha::Exceptions::Authorization::Unauthorized->throw("Configuration prevents password changes by unauthorized users"); |
| 87 |
} |
| 88 |
} |
| 89 |
|
| 90 |
## Change password |
| 91 |
# TODO: Use $patron->set_password when bug 21178 is pushed |
| 92 |
my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password ); |
| 93 |
if ( !$is_valid ) { |
| 94 |
if ( $error eq 'too_short' ) { |
| 95 |
my $min_length = C4::Context->preference('minPasswordLength'); |
| 96 |
$min_length = 3 if not $min_length or $min_length < 3; |
| 97 |
|
| 98 |
my $password_length = length($password) // 0; |
| 99 |
Koha::Exceptions::Password::TooShort->throw( |
| 100 |
length => $password_length, min_length => $min_length ); |
| 101 |
} |
| 102 |
elsif ( $error eq 'has_whitespaces' ) { |
| 103 |
Koha::Exceptions::Password::TrailingWhitespaces->throw( |
| 104 |
"Password contains trailing spaces, which is forbidden."); |
| 105 |
} |
| 106 |
elsif ( $error eq 'too_weak' ) { |
| 107 |
Koha::Exceptions::Password::TooWeak->throw("Password is too weak"); |
| 108 |
} |
| 109 |
} |
| 110 |
|
| 111 |
$patron->update_password( $patron->userid, $password ); |
| 112 |
return $c->render( status => 200, openapi => "" ); |
| 113 |
} |
| 114 |
catch { |
| 115 |
unless ( blessed $_ && $_->can('rethrow') ) { |
| 116 |
return $c->render( status => 500, openapi => { error => "$_" } ); |
| 117 |
} |
| 118 |
# an exception was raised. return 400 with the stringified exception |
| 119 |
return $c->render( status => 400, openapi => { error => "$_" } ); |
| 120 |
}; |
| 121 |
} |
| 122 |
|
| 123 |
1; |