Bugzilla – Attachment 153575 Details for
Bug 32739
REST API: Extend endpoint /auth/password/validation for cardnumber
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 32739: Allow other patron identifier on pwd validation
Bug-32739-Allow-other-patron-identifier-on-pwd-val.patch (text/plain), 3.06 KB, created by
Tomás Cohen Arazi (tcohen)
on 2023-07-17 18:52:51 UTC
(
hide
)
Description:
Bug 32739: Allow other patron identifier on pwd validation
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2023-07-17 18:52:51 UTC
Size:
3.06 KB
patch
obsolete
>From 94ab498bf2db06fc1eb390e9afa5aa76e5429689 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Mon, 17 Jul 2023 15:48:20 -0300 >Subject: [PATCH] Bug 32739: Allow other patron identifier on pwd validation > >This patch takes a step forward on the password validation endpoint, by >renaming the `userid` attribute to `identifier` and making it be allowed >to be the patron's cardnumber. > >The implementation relies on `C4::Auth::checkpw` to query for the >patron. > >To test: >1. Apply this patches >2. Run: > $ ktd --shell > k$ prove t/db_dependent/api/v1/password_validation.t >=> SUCCESS: Tests pass! >3. Sign off :-D >--- > Koha/REST/V1/Auth/Password.pm | 15 ++++++++------- > api/v1/swagger/paths/auth.yaml | 15 +++++++++++---- > 2 files changed, 19 insertions(+), 11 deletions(-) > >diff --git a/Koha/REST/V1/Auth/Password.pm b/Koha/REST/V1/Auth/Password.pm >index 9c99fd230ca..7533a5decdd 100644 >--- a/Koha/REST/V1/Auth/Password.pm >+++ b/Koha/REST/V1/Auth/Password.pm >@@ -40,19 +40,20 @@ Controller method that checks a patron's password > > sub validate { > my $c = shift->openapi->valid_input or return; >- my $body = $c->validation->param('body'); >- my $userid = $body->{userid} // ''; >- my $patron = Koha::Patrons->find({ userid => $userid }); > >- unless ($patron) { >+ my $body = $c->req->json; >+ >+ my $identifier = $body->{identifier}; >+ >+ unless ( defined $identifier ) { > return $c->render( status => 400, openapi => { error => "Validation failed" } ); > } > >- my $password = $body->{password} // ""; >+ my $password = $body->{password} // ""; > > return try { >- my ($status, $cardnumber, $userid) = C4::Auth::checkpw($patron->userid, $password ); >- unless ( $status ) { >+ my ( $status, $cardnumber, $userid ) = C4::Auth::checkpw( $identifier, $password ); >+ unless ($status) { > return $c->render( > status => 400, > openapi => { error => "Validation failed" } >diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml >index 04e89e67360..81ef9501590 100644 >--- a/api/v1/swagger/paths/auth.yaml >+++ b/api/v1/swagger/paths/auth.yaml >@@ -1062,18 +1062,25 @@ > parameters: > - name: body > in: body >- description: A JSON object containing username and password information >+ description: | >+ A JSON object containing a patron identifier and password information. >+ >+ The identifier will be used to match patrons on the database using the >+ following order: >+ >+ * userid >+ * cardnumber > schema: > type: object > properties: >- userid: >- description: Username >+ identifier: >+ description: A patron identifier (`userid` or `cardnumber`) > type: string > password: > description: Password (plain text) > type: string > required: >- - userid >+ - identifier > - password > additionalProperties: false > produces: >-- >2.41.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 32739
:
153574
|
153575
|
153683
|
153684
|
153776
|
153777
|
153816
|
153817
|
153841
|
153842
|
153885
|
153886
|
153887