Bugzilla – Attachment 159957 Details for
Bug 35204
REST API: POST endpoint /auth/password/validation dies on patron with expired password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35204: Prevent an expired password from throwing a 500 error
Bug-35204-Prevent-an-expired-password-from-throwin.patch (text/plain), 2.01 KB, created by
Tomás Cohen Arazi (tcohen)
on 2023-12-18 12:13:09 UTC
(
hide
)
Description:
Bug 35204: Prevent an expired password from throwing a 500 error
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2023-12-18 12:13:09 UTC
Size:
2.01 KB
patch
obsolete
>From dc420528dafe8b70722caffdc4c7fcb28627d33e Mon Sep 17 00:00:00 2001 >From: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> >Date: Wed, 6 Dec 2023 10:03:45 +0000 >Subject: [PATCH] Bug 35204: Prevent an expired password from throwing a 500 > error > >Currently when a patron with an expired password is authenticated via the API a 500 error is returned rather than a 400 "Validation failed" error. This patch catches the return value for an expired password and returns the validation failure before the patron search is attempted. > >Test plan: >1) Choose a patron and set their password expiry date to a date in the past >2) Send a request to auth/password/validation as an authenticated user with that patron's details >3) The response should be a 500 error >4) Apply patch >5) Repeat steps 1-3 and this time the response should be a 400 code with an error message of "Password expired" > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/REST/V1/Auth/Password.pm | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > >diff --git a/Koha/REST/V1/Auth/Password.pm b/Koha/REST/V1/Auth/Password.pm >index 4369ffd187c..9889bf45a7d 100644 >--- a/Koha/REST/V1/Auth/Password.pm >+++ b/Koha/REST/V1/Auth/Password.pm >@@ -41,7 +41,7 @@ Controller method that checks a patron's password > sub validate { > my $c = shift->openapi->valid_input or return; > >- my $body = $c->req->json; >+ my $body = $c->req->json; > my $identifier = $body->{identifier}; > my $userid = $body->{userid}; > >@@ -72,10 +72,11 @@ sub validate { > > return try { > my ( $status, $THE_cardnumber, $THE_userid ) = C4::Auth::checkpw( $identifier, $password ); >- unless ($status) { >+ unless ( $status && $status > 0 ) { >+ my $error_response = $status == -2 ? 'Password expired' : 'Validation failed'; > return $c->render( > status => 400, >- openapi => { error => "Validation failed" } >+ openapi => { error => $error_response } > ); > } > >-- >2.43.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35204
:
159612
|
159939
|
159940
|
159956
| 159957