Attachment 131319 Details for Bug 25936 – Bug 25936: Add option to send password change notices

[patch] Bug 25936: Add option to send password change notices

Bug-25936-Add-option-to-send-password-change-notic.patch (text/plain), 7.40 KB, created by Marcel de Rooy on 2022-03-03 12:45:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2022-03-03 12:45:09 UTC

Size: 7.40 KB

patch

obsolete

>From 05711220f904f3753d448dea4913d65a42d06561 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Thu, 3 Mar 2022 12:03:42 +0000
>Subject: [PATCH] Bug 25936: Add option to send password change notices
>Content-Type: text/plain; charset=utf-8
>
>This patch add a new security notice to allow sending notification of
>password changes to patrons. If enabled, the 'PASSCHANGE' notice will be
>sent to respective patrons whenever their password is updated.
>
>Test plan
>1) Run the database updates
>2) Enable the new feature by setting 'NotifyPasswordChange' to 'Notify'
>3) Change a users password
>4) Check that the notice appears in the patrons notices
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> Koha/Patron.pm                                | 38 ++++++++++++++++++-
> .../data/mysql/atomicupdate/bug_25936.pl      | 27 +++++++++++++
> .../mysql/en/mandatory/sample_notices.yml     | 15 ++++++++
> installer/data/mysql/mandatory/sysprefs.sql   |  1 +
> .../en/modules/admin/preferences/patrons.pref |  6 +++
> 5 files changed, 86 insertions(+), 1 deletion(-)
> create mode 100755 installer/data/mysql/atomicupdate/bug_25936.pl
>
>diff --git a/Koha/Patron.pm b/Koha/Patron.pm
>index 9968d36350..d8197e5ba6 100644
>--- a/Koha/Patron.pm
>+++ b/Koha/Patron.pm
>@@ -25,10 +25,11 @@ use JSON qw( to_json );
> use Unicode::Normalize qw( NFKD );
> 
> use C4::Context;
>+use C4::Auth qw( checkpw_hash );
> use C4::Log qw( logaction );
> use Koha::Account;
> use Koha::ArticleRequests;
>-use C4::Letters;
>+use C4::Letters qw( GetPreparedLetter EnqueueLetter SendQueuedMessages );
> use Koha::AuthUtils;
> use Koha::Checkouts;
> use Koha::CirculationRules;
>@@ -875,6 +876,41 @@ sub set_password {
>         }
>     }
> 
>+    if ( C4::Context->preference('NotifyPasswordChange') ) {
>+        my $self_from_storage = $self->get_from_storage;
>+        if ( !C4::Auth::checkpw_hash( $password, $self_from_storage->password ) ) {
>+            my $emailaddr = $self_from_storage->notice_email_address;
>+
>+            # if we manage to find a valid email address, send notice
>+            if ($emailaddr) {
>+                eval {
>+                    my $letter = GetPreparedLetter(
>+                        module      => 'members',
>+                        letter_code => 'PASSCHANGE',
>+                        branchcode  => $self_from_storage->branchcode,
>+                        ,
>+                        lang   => $self_from_storage->lang || 'default',
>+                        tables => {
>+                            'branches'  => $self_from_storage->branchcode,
>+                            'borrowers' => $self_from_storage->borrowernumber,
>+                        },
>+                        want_librarian => 1,
>+                    ) or return;
>+
>+                    my $message_id = EnqueueLetter(
>+                        {
>+                            letter                 => $letter,
>+                            borrowernumber         => $self_from_storage->id,
>+                            to_address             => $emailaddr,
>+                            message_transport_type => 'email'
>+                        }
>+                    );
>+                    SendQueuedMessages( { message_id => $message_id } );
>+                };
>+            }
>+        }
>+    }
>+
>     my $digest = Koha::AuthUtils::hash_password($password);
> 
>     # We do not want to call $self->store and retrieve password from DB
>diff --git a/installer/data/mysql/atomicupdate/bug_25936.pl b/installer/data/mysql/atomicupdate/bug_25936.pl
>new file mode 100755
>index 0000000000..ded356bc6b
>--- /dev/null
>+++ b/installer/data/mysql/atomicupdate/bug_25936.pl
>@@ -0,0 +1,27 @@
>+use Modern::Perl;
>+
>+return {
>+    bug_number => "25936",
>+    description => "A password change notification feature",
>+    up => sub {
>+        my ($args) = @_;
>+        my ($dbh, $out) = @$args{qw(dbh out)};
>+
>+        # Add PASSCHANGE notice
>+        $dbh->do( q{
>+            INSERT IGNORE INTO letter (module, code, name, title, content, message_transport_type) VALUES ('members', 'PASSCHANGE', 'Notification of password change', 'Library account password change notification',
>+            "Dear [% borrower.firstname %] [% borrower.surname %],
>+
>+            Someone has changed your library user account password.
>+
>+            If this is unexpected, please contact the library.
>+            ", 'email');
>+        });
>+
>+        # Add systempreference
>+        $dbh->do(q{
>+            INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type)
>+            VALUES ('NotifyPasswordChange','0','','Notify patrons whenever their password is changed.','YesNo')
>+        });
>+    },
>+};
>diff --git a/installer/data/mysql/en/mandatory/sample_notices.yml b/installer/data/mysql/en/mandatory/sample_notices.yml
>index ffcb4cb5d4..d54b24c330 100644
>--- a/installer/data/mysql/en/mandatory/sample_notices.yml
>+++ b/installer/data/mysql/en/mandatory/sample_notices.yml
>@@ -1024,6 +1024,21 @@ tables:
>             - ""
>             - "If you did not initiate this request, you may safely ignore this one-time message. The request will expire shortly."
> 
>+        - module: members
>+          code: PASSCHANGE
>+          branchcode: ""
>+          name: "Notification of password change"
>+          is_html: 1
>+          title: "Library account password change notification for [% patron.firstname %] [% patron.surname %]"
>+          message_transport_type: email
>+          lang: default
>+          content:
>+            - "Dear [% patron.firstname %] [% patron.surname %],"
>+            - ""
>+            - "Someone has changed your library user account password."
>+            - ""
>+            - "If this is unexpected, please contact the library"
>+
>         - module: members
>           code: PASSWORD_RESET
>           branchcode: ""
>diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql
>index dd83a00fd8..f79e7d4169 100644
>--- a/installer/data/mysql/mandatory/sysprefs.sql
>+++ b/installer/data/mysql/mandatory/sysprefs.sql
>@@ -365,6 +365,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
> ('NoticeCSS','',NULL,'Notices CSS url.','free'),
> ('NoticesLog','0',NULL,'If enabled, log changes to notice templates','YesNo'),
> ('NotifyBorrowerDeparture','30',NULL,'Define number of days before expiry where circulation is warned about patron account expiry','Integer'),
>+('NotifyPasswordChange','0',NULL,'Notify patrons whenever their password is changed.','YesNo'),
> ('NovelistSelectEnabled','0',NULL,'Enable Novelist Select content.  Requires Novelist Profile and Password','YesNo'),
> ('NovelistSelectPassword','',NULL,'Novelist select user Password','free'),
> ('NovelistSelectProfile','',NULL,'Novelist Select user Profile','free'),
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref
>index 9ef410f24c..6a7294132b 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref
>@@ -148,6 +148,12 @@ Patrons:
>                1: Send
>                0: "Don't send"
>          - an email to newly created patrons with their account details.
>+     -
>+         - pref: NotifyPasswordChange
>+           choices:
>+               1: Notify
>+               0: "Don't notify"
>+         - patrons whenever their password is changed.
>      -
>          - pref: UseEmailReceipts
>            choices:
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 25936: 131316 | 131317 | 131318 | 131319 | 131519 | 131520 | 131521 | 131543 | 141080 | 141081 | 141082 | 141104 | 141105 | 141106 | 141107 | 141108 | 141306 | 141307