|
Lines 19-24
use Modern::Perl;
Link Here
|
| 19 |
|
19 |
|
| 20 |
use Mojo::Base 'Mojolicious::Controller'; |
20 |
use Mojo::Base 'Mojolicious::Controller'; |
| 21 |
|
21 |
|
|
|
22 |
use C4::Auth qw(checkpw_internal); |
| 23 |
|
| 22 |
use Koha::Patrons; |
24 |
use Koha::Patrons; |
| 23 |
|
25 |
|
| 24 |
use Scalar::Util qw(blessed); |
26 |
use Scalar::Util qw(blessed); |
|
Lines 73-76
sub set {
Link Here
|
| 73 |
}; |
75 |
}; |
| 74 |
} |
76 |
} |
| 75 |
|
77 |
|
|
|
78 |
=head3 set_public |
| 79 |
|
| 80 |
Controller method that sets a patron's password, for unprivileged users |
| 81 |
|
| 82 |
=cut |
| 83 |
|
| 84 |
sub set_public { |
| 85 |
|
| 86 |
my $c = shift->openapi->valid_input or return; |
| 87 |
|
| 88 |
my $body = $c->validation->param('body'); |
| 89 |
my $patron_id = $c->validation->param('patron_id'); |
| 90 |
|
| 91 |
unless ( C4::Context->preference('OpacPasswordChange') ) { |
| 92 |
return $c->render( |
| 93 |
status => 403, |
| 94 |
openapi => { error => "Configuration prevents password changes by unprivileged users" } |
| 95 |
); |
| 96 |
} |
| 97 |
|
| 98 |
my $user = $c->stash('koha.user'); |
| 99 |
|
| 100 |
unless ( $user->borrowernumber == $patron_id ) { |
| 101 |
return $c->render( |
| 102 |
status => 403, |
| 103 |
openapi => { |
| 104 |
error => "Changing other patron's password is forbidden" |
| 105 |
} |
| 106 |
); |
| 107 |
} |
| 108 |
|
| 109 |
my $old_password = $body->{old_password}; |
| 110 |
my $password = $body->{password}; |
| 111 |
my $password_2 = $body->{password_2}; |
| 112 |
|
| 113 |
unless ( $password eq $password_2 ) { |
| 114 |
return $c->render( status => 400, openapi => { error => "Passwords don't match" } ); |
| 115 |
} |
| 116 |
|
| 117 |
return try { |
| 118 |
my $dbh = C4::Context->dbh; |
| 119 |
unless ( checkpw_internal($dbh, $user->userid, $old_password ) ) { |
| 120 |
Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password"); |
| 121 |
} |
| 122 |
|
| 123 |
## Change password |
| 124 |
$user->set_password($password); |
| 125 |
|
| 126 |
return $c->render( status => 200, openapi => "" ); |
| 127 |
} |
| 128 |
catch { |
| 129 |
unless ( blessed $_ && $_->can('rethrow') ) { |
| 130 |
return $c->render( status => 500, openapi => { error => "$_" } ); |
| 131 |
} |
| 132 |
|
| 133 |
# an exception was raised. return 400 with the stringified exception |
| 134 |
return $c->render( status => 400, openapi => { error => "$_" } ); |
| 135 |
}; |
| 136 |
} |
| 137 |
|
| 76 |
1; |
138 |
1; |
| 77 |
- |
|
|