Attachment 156512 Details for Bug 30700 – Bug 30700: Allow staff users to change their password via staff client

[patch] Bug 30700: Allow staff users to change their password via staff client

Bug-30700-Allow-staff-users-to-change-their-passwo.patch (text/plain), 7.00 KB, created by Victor Grousset/tuxayo on 2023-10-04 05:16:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Victor Grousset/tuxayo

Created: 2023-10-04 05:16:07 UTC

Size: 7.00 KB

patch

obsolete

>From 3fd9fb98f509b01b34047b81bab79cc32e2fcc36 Mon Sep 17 00:00:00 2001
>From: Aleisha Amohia <aleishaamohia@hotmail.com>
>Date: Fri, 6 May 2022 02:04:35 +0000
>Subject: [PATCH] Bug 30700: Allow staff users to change their password via
> staff client
>
>Patrons who can log into the staff client (have the 'catalogue'
>permission) should be able to change their own password.
>
>To test:
>0) Apply the patch, install database updates, restart services. Go to System preferences and enable the StaffLoginResetPassword system preference.
>1) Create a user with only 'catalogue' permissions (Patron A)
>2) Log in to the staff client as Patron A
>3) Click the menu with your username in the top-right of the window.
>Click the 'your account' menu link.
>4) Confirm you are forced to a login screen, so you cannot view your
>account, which is where the 'change password' link is normally found.
>5) Try to access the page to change your password directly
>http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X
>(swap Patron A's borrowernumber in). Confirm you are forced to a login
>screen.
>6) Apply this patch and restart services. Go back to the mainpage logged
>in as Patron A.
>7) Click the menu with your username in the top-right of the window.
>Notice there is now a 'Change password' menu link. Go to 'change
>password'.
>8) Confirm you are now shown a page to change your password. Change your
>password, and confirm you are redirect to the mainpage.
>9) Try to access the page to change someone else's page directly
>http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X
>(swap some other borrowernumber in). Confirm you are redirected to a
>404.
>10) Log out and log back in as your original borrower. Confirm you are
>able to change your password as normal.
>
>Sponsored-by: Education Services Australia SCIS
>
>Signed-off-by: David Nind <david@davidnind.com>
>Signed-off-by: Sam Lau <samalau@gmail.com>
>Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>
>Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
>---
> .../intranet-tmpl/prog/en/includes/header.inc | 6 ++++++
> .../prog/en/includes/members-toolbar.inc | 4 +++-
> members/member-password.pl | 18 +++++++++++++++---
> 3 files changed, 24 insertions(+), 4 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
>index 0ab7ddbfdc..6820c289d9 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
>@@ -203,11 +203,17 @@
> <a class="toplinks" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% loggedinusernumber | html %]">My checkouts</a>
> </li>
> [% END %]
>+
> [% IF Koha.Preference( 'CookieConsent' ) && JSConsents.all('staffConsent').size %]
> <li class="toplinks-myconsents">
> <a id="viewCookieConsents" href="#" class="toplinks">My consents</a>
> </li>
> [% END %]
>+
>+ <li class ="toplinks-changepassword">
>+ <a class="toplinks" href="/cgi-bin/koha/members/member-password.pl?member=[% loggedinusernumber | html %]">Change password</a>
>+ </li>
>+
> <li>
> <a id="logout" class="toplinks" href="/cgi-bin/koha/mainpage.pl?logout.x=1">Log out</a>
> </li>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>index 8e277919a6..82681b131d 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>@@ -13,9 +13,11 @@
> [% IF patron.is_adult AND Koha.Preference("borrowerRelationship") %]
> <a id="addchild" class="btn btn-default" href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;guarantor_id=[% patron.borrowernumber | html %]"> Add guarantee</a>
> [% END %]
>- <a id="changepassword" class="btn btn-default" href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]"> Change password</a>
> <a id="duplicate" class="btn btn-default" href="/cgi-bin/koha/members/memberentry.pl?op=duplicate&amp;borrowernumber=[% patron.borrowernumber | html %]"> Duplicate</a>
> [% END %]
>+ [% IF CAN_user_borrowers_edit_borrowers || patron.borrowernumber == logged_in_user.borrowernumber %]
>+ <a id="changepassword" class="btn btn-default" href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]"> Change password</a>
>+ [% END %]
> 
> [% IF CAN_user_circulate_circulate_remaining_permissions %]
> <div class="btn-group">
>diff --git a/members/member-password.pl b/members/member-password.pl
>index d44f29d0f7..40adcfb0fc 100755
>--- a/members/member-password.pl
>+++ b/members/member-password.pl
>@@ -28,11 +28,19 @@ my ( $template, $loggedinuser, $cookie, $staffflags ) = get_template_and_user(
> template_name => "members/member-password.tt",
> query => $input,
> type => "intranet",
>- flagsrequired => { borrowers => 'edit_borrowers' },
>+ flagsrequired => { catalogue => 1 },
> }
> );
> 
> my $patron_id = $input->param('member');
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser );
>+
>+if ( !$logged_in_user->has_permission({ borrowers => 'edit_borrowers' }) and $loggedinuser != $patron_id ) {
>+ print $input->redirect("/cgi-bin/koha/errors/404.pl");
>+
>+} else {
>+# patron has permission to edit other borrowers, or is changing their own password
>+
> my $destination = $input->param('destination');
> my $newpassword = $input->param('newpassword');
> my $newpassword2 = $input->param('newpassword2');
>@@ -40,7 +48,6 @@ my $new_user_id = $input->param('newuserid');
> 
> my @errors;
> 
>-my $logged_in_user = Koha::Patrons->find( $loggedinuser );
> my $patron = Koha::Patrons->find( $patron_id );
> output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
> 
>@@ -68,7 +75,10 @@ if ( $newpassword and not @errors) {
> $patron->userid($new_user_id)->store
> if $new_user_id and $new_user_id ne $patron->userid;
> $template->param( newpassword => $newpassword );
>- if ( $destination eq 'circ' ) {
>+ if ( !$patron->has_permission({ borrowers => 'edit_borrowers' }) ) {
>+ print $input->redirect("/cgi-bin/koha/mainpage.pl");
>+ }
>+ elsif ( $destination eq 'circ' ) {
> print $input->redirect("/cgi-bin/koha/circ/circulation.pl?findborrower=" . $patron->cardnumber);
> }
> else {
>@@ -107,4 +117,6 @@ if ( scalar(@errors) ) {
> }
> }
> 
>+} # patron has permission to edit other borrowers, or is changing their own password
>+
> output_html_with_http_headers $input, $cookie, $template->output;
>-- 
>2.42.0

Actions: View | Diff | Splinter Review

Attachments on bug 30700: 134669 | 134772 | 135087 | 135173 | 135174 | 135176 | 153248 | 153249 | 153250 | 153290 | 153291 | 153292 | 156512 | 156513 | 156514 | 156515 | 156516