Attachment 171296 Details for Bug 37887 – Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

[patch] Bug 37887: OPAC password recovery needs to use a cud- op while POSTing new password

Bug-37887-OPAC-password-recovery-needs-to-use-a-cu.patch (text/plain), 3.55 KB, created by Phil Ringnalda on 2024-09-11 03:39:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Phil Ringnalda

Created: 2024-09-11 03:39:20 UTC

Size: 3.55 KB

patch

obsolete

>From 9c0cffc2f956d67bc1a8a3b0daadaeed3c01fa7f Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Tue, 10 Sep 2024 20:17:20 -0700
>Subject: [PATCH] Bug 37887: OPAC password recovery needs to use a cud- op
> while POSTing new password
>
>To pass xt/find-missing-op-in-forms.t after bug 37728 updates it to notice
>that there can be more than one form in a template, opac-password-recovery.tt
>needs to have a param named 'op' which starts with 'cud-' for the form that
>POSTs the new password.
>
>Luckily, testing this doesn't require that you set Koha up to actually send
>email (though you can), because you can get the link to reset the password
>by looking at the list of notices sent to the patron in the staff interface:
>the failure to send notice works just fine.
>
>Test plan:
> 1. There's no behavior change to test, you just need to see that resetting
>    the password still works, so start with the patch applied.
> 2. Administration - System preferences - change OpacResetPassword to allowed
> 3. Set a patron so you can use them, which requires that you know the
>    username, and they have an email address. I give Acosta, Edna one of
>    my email addresses, and copy her cardnumber.
> 4. Open the OPAC, and below the login form click the "Forgot your password?"
>    link
> 5. Enter the cardnumber for Login and the email you used for Email and
>    click Submit. If you didn't set up sending email, you'll get an error
>    message, but ignore it, not a problem
> 6. Back in the staff interface, check out to the patron you are using, and
>    on the left sidebar choose Notices and find the Koha password recovery
>    notice and click that linked phrase
> 7. In the popup with the notice text, open the recovery link in a new tab
> 8. Following the instructions for the content of a new password, enter one
>    in both fields and click Submit
> 9  In the success message, click the link to Log in to your account and
>    log in with the new password
>
>Sponsored-by: Chetco Community Public Library
>---
> .../opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt    | 1 +
> opac/opac-password-recovery.pl                                  | 2 +-
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
>index f83859599e..1fefb27964 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
>@@ -151,6 +151,7 @@
>                         [% UNLESS ( errLinkNotValid ) %]
>                             <form id="mainform" name="mainform" action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
>                                 [% INCLUDE 'csrf-token.inc' %]
>+                                <input type="hidden" name="op" value="cud-reset_password" />
>                                 <legend class="sr-only">Password not valid</legend>
>                                 <input type="hidden" name="koha_login_context" value="opac" />
>                                 <fieldset class="brief">
>diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl
>index 437ec121af..08d1f38262 100755
>--- a/opac/opac-password-recovery.pl
>+++ b/opac/opac-password-recovery.pl
>@@ -148,7 +148,7 @@ if ( $op eq 'cud-sendEmail' || $op eq 'cud-resendEmail' ) {
>         );
>     }
> }
>-elsif ( $query->param('passwordReset') ) {
>+elsif ( $op eq 'cud-reset_password' ) {
>     ( $borrower_number, $username ) = GetValidLinkInfo($uniqueKey);
> 
>     my $error;
>-- 
>2.44.0

Actions: View | Diff | Splinter Review

Attachments on bug 37887: 171296 | 171324 | 171544