Bugzilla – Attachment 126633 Details for
Bug 29272
API not respecting $category->effective_change_password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29272: Make public password changing honour category constraints
Bug-29272-Make-public-password-changing-honour-cat.patch (text/plain), 1.73 KB, created by
David Nind
on 2021-10-20 23:20:11 UTC
(
hide
)
Description:
Bug 29272: Make public password changing honour category constraints
Filename:
MIME Type:
Creator:
David Nind
Created:
2021-10-20 23:20:11 UTC
Size:
1.73 KB
patch
obsolete
>From 2b83d3790d26fbba80dc8a12509ae0ff06ab8119 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Tue, 19 Oct 2021 10:29:55 -0300 >Subject: [PATCH] Bug 29272: Make public password changing honour category > constraints > >This patch makes the public API routes validate >$user->category->effective_change_password before allowing the change. > >To test: >1. Apply the regression tests patch >2. Run: > $ kshell > k$ prove t/db_dependent/api/v1/patrons_password.t >=> FAIL: Tests fail, it allows the first change instead of returning > 403. >3. Apply this patch >4. Repeat 2 >=> SUCCESS: Tests pass! >5. Sign off :-D > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> > >Signed-off-by: David Nind <david@davidnind.com> >--- > Koha/REST/V1/Patrons/Password.pm | 10 ++++++++++ > 1 file changed, 10 insertions(+) > >diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm >index bb53ad5d4c..5aaaa6b659 100644 >--- a/Koha/REST/V1/Patrons/Password.pm >+++ b/Koha/REST/V1/Patrons/Password.pm >@@ -90,6 +90,7 @@ sub set_public { > my $body = $c->validation->param('body'); > my $patron_id = $c->validation->param('patron_id'); > >+ # short-circuit early > unless ( C4::Context->preference('OpacPasswordChange') ) { > return $c->render( > status => 403, >@@ -108,6 +109,15 @@ sub set_public { > ); > } > >+ unless ( $user->category->effective_change_password ) { >+ return $c->render( >+ status => 403, >+ openapi => { >+ error => "Changing password is forbidden" >+ } >+ ); >+ } >+ > my $old_password = $body->{old_password}; > my $password = $body->{password}; > my $password_2 = $body->{password_repeated}; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29272
:
126501
|
126502
|
126632
|
126633
|
126814
|
126976
|
126977
|
126978