Attachment 37491 Details for Bug 13068 – Bug 8753 - Add forgot password link to OPAC

[patch] Bug 8753 - Add forgot password link to OPAC

Bug-8753---Add-forgot-password-link-to-OPAC.patch (text/plain), 28.63 KB, created by Blou on 2015-04-03 19:14:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Blou

Created: 2015-04-03 19:14:28 UTC

Size: 28.63 KB

patch

obsolete

>From 131767872159da444963c3c05ea041b0f1c1a2d1 Mon Sep 17 00:00:00 2001
>From: simith <simith@inlibro.com>
>Date: Wed, 11 Mar 2015 13:52:59 -0400
>Subject: [PATCH] Bug 8753 - Add forgot password link to OPAC
>
> This redo includes the following
> - usage of the template letters for the email instead of a .tt (that feature didn't exist when the functionnality was initially coded for our client)
> - removal of the prog version
> - removal of the code that was initially put into Members.pm
> - Added a letter into updatedatabase.pl and sample_notices.sql
> - Of course, rebase to latest master.
>
> The rest remain unchanged since the previous comments/approvals.  As such, what worked before should still work.
>
> TEST PLAN:
>
> 1) apply the patch
> 2) go to system preferences OPAC>>Privacy and set 'OpacResetPassword' to ON.  That will cause the link 'Forgot yo
>    2b) make sure that OpacPasswordChange is also ON.
> 3) refresh front page, click on 'Forgot your password' and enter a VALID address (one that is associated to an en
>    3b) Also try an INVALID address (valid yet not in your koha db).  An error message will show up.
> 4) An email should be received at that address with a link.
> 5) Follow the link in the mail to fill the new password.
>    Until a satisfactory new password is entered, the old password is not reset.
>  6) Go to main page try the new password.
>
>http://bugs.koha-community.org/show_bug.cgi?id=13068
>---
> C4/Passwordrecovery.pm                             | 159 +++++++++++++++++++++
> Koha/Schema/Result/BorrowerPasswordRecovery.pm     |  66 +++++++++
> .../data/mysql/en/mandatory/sample_notices.sql     |   6 +-
> installer/data/mysql/kohastructure.sql             |  11 ++
> installer/data/mysql/sysprefs.sql                  |   1 +
> installer/data/mysql/updatedatabase.pl             |  17 +++
> .../prog/en/modules/admin/preferences/opac.pref    |   8 ++
> .../opac-tmpl/bootstrap/en/includes/masthead.inc   |   3 +
> .../opac-tmpl/bootstrap/en/modules/opac-auth.tt    |   3 +
> .../bootstrap/en/modules/opac-password-recovery.tt | 132 +++++++++++++++++
> opac/opac-password-recovery.pl                     | 156 ++++++++++++++++++++
> 11 files changed, 561 insertions(+), 1 deletion(-)
> create mode 100644 C4/Passwordrecovery.pm
> create mode 100644 Koha/Schema/Result/BorrowerPasswordRecovery.pm
> create mode 100644 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
> create mode 100755 opac/opac-password-recovery.pl
>
>diff --git a/C4/Passwordrecovery.pm b/C4/Passwordrecovery.pm
>new file mode 100644
>index 0000000..f1b26e9
>--- /dev/null
>+++ b/C4/Passwordrecovery.pm
>@@ -0,0 +1,159 @@
>+package C4::Passwordrecovery;
>+
>+# Copyright 2014 PTFS Europe
>+#
>+# This file is part of Koha.
>+#
>+# Koha is free software; you can redistribute it and/or modify it
>+# under the terms of the GNU General Public License as published by
>+# the Free Software Foundation; either version 3 of the License, or
>+# (at your option) any later version.
>+#
>+# Koha is distributed in the hope that it will be useful, but
>+# WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU General Public License for more details.
>+#
>+# You should have received a copy of the GNU General Public License
>+# along with Koha; if not, see <http://www.gnu.org/licenses>.
>+
>+use Modern::Perl;
>+use C4::Context;
>+
>+use vars qw($VERSION @ISA @EXPORT);
>+
>+BEGIN {
>+    # set the version for version checking
>+    $VERSION = 3.07.00.049;
>+    require Exporter;
>+    @ISA    = qw(Exporter);
>+    push @EXPORT, qw(
>+        &ValidateBorrowernumber
>+        &SendPasswordRecoveryEmail
>+        &GetValidLinkInfo
>+    );
>+}
>+
>+=head1 NAME
>+
>+C4::Passwordrecovery - Koha password recovery module
>+
>+=head1 SYNOPSIS
>+
>+use C4::Passwordrecovery;
>+
>+=head1 FUNCTIONS
>+
>+=head2 ValidateBorrowernumber
>+
>+$alread = ValidateBorrowernumber( $borrower_number );
>+
>+Check if the system already start recovery
>+
>+Returns true false
>+
>+=cut
>+
>+sub ValidateBorrowernumber {
>+    my ($borrower_number) = @_;
>+    my $schema = Koha::Database->new->schema;
>+
>+    my $rs = $schema->resultset('BorrowerPasswordRecovery')->search(
>+    {
>+       borrowernumber => $borrower_number,
>+       valid_until => \'> NOW()'
>+    }, {
>+        columns => 'borrowernumber'
>+    });
>+
>+    if ($rs->next){
>+        return 1;
>+    }
>+
>+    return 0;
>+}
>+
>+=head2 GetValidLinkInfo
>+
>+    Check if the link is still valid and return some info.
>+
>+=cut
>+
>+sub GetValidLinkInfo {
>+    my ($uniqueKey) = @_;
>+    my $dbh = C4::Context->dbh;
>+    my $query = '
>+    SELECT borrower_password_recovery.borrowernumber, userid
>+    FROM borrower_password_recovery, borrowers
>+    WHERE borrowers.borrowernumber = borrower_password_recovery.borrowernumber
>+    AND NOW() < valid_until
>+    AND uuid = ?
>+    ';
>+    my $sth = $dbh->prepare($query);
>+    $sth->execute($uniqueKey);
>+    return $sth->fetchrow;
>+}
>+
>+=head2 SendPasswordRecoveryEmail
>+
>+ It creates an email using the templates and send it to the user, using the specified email
>+
>+=cut
>+
>+sub SendPasswordRecoveryEmail {
>+    my $borrower = shift; # from GetMember
>+    my $userEmail = shift; #to_address (the one specified in the request)
>+    my $protocol = shift; #only required to determine if 'http' or 'https'
>+    my $update = shift;
>+
>+    my $schema = Koha::Database->new->schema;
>+
>+    # generate UUID
>+    my @chars = ("A".."Z", "a".."z", "0".."9");
>+    my $uuid_str;
>+    $uuid_str .= $chars[rand @chars] for 1..32;
>+
>+    # insert into database
>+    my $expirydate = DateTime->now(time_zone => C4::Context->tz())->add( days => 2 );
>+    if($update){
>+        my $rs = $schema->resultset('BorrowerPasswordRecovery')->search(
>+        {
>+            borrowernumber => $borrower->{'borrowernumber'},
>+        });
>+        $rs->update({uuid => $uuid_str, valid_until => $expirydate->datetime()});
>+    } else {
>+         my $rs = $schema->resultset('BorrowerPasswordRecovery')->create({
>+            borrowernumber=>$borrower->{'borrowernumber'},
>+            uuid => $uuid_str,
>+            valid_until=> $expirydate->datetime()
>+         });
>+    }
>+
>+    # create link
>+    my $uuidLink = $protocol . C4::Context->preference( 'OPACBaseURL' ) . "/cgi-bin/koha/opac-password-recovery.pl?uniqueKey=$uuid_str";
>+
>+    # prepare the email
>+    my $letter = C4::Letters::GetPreparedLetter (
>+        module => 'members',
>+        letter_code => 'PASSWORD_RESET',
>+        branchcode => $borrower->{branchcode},
>+        substitute => {passwordreseturl => $uuidLink, user => $borrower->{userid} },
>+    );
>+
>+    # define to/from emails
>+    my $kohaEmail = C4::Context->preference( 'KohaAdminEmailAddress' ); # from
>+
>+    C4::Letters::EnqueueLetter( {
>+         letter => $letter,
>+         borrowernumber => $borrower->{borrowernumber},
>+         to_address => $userEmail,
>+         from_address => $kohaEmail,
>+         message_transport_type => 'email',
>+    } );
>+
>+    return 1;
>+}
>+
>+END { }    # module clean-up code here (global destructor)
>+
>+1;
>\ No newline at end of file
>diff --git a/Koha/Schema/Result/BorrowerPasswordRecovery.pm b/Koha/Schema/Result/BorrowerPasswordRecovery.pm
>new file mode 100644
>index 0000000..5b41fbf
>--- /dev/null
>+++ b/Koha/Schema/Result/BorrowerPasswordRecovery.pm
>@@ -0,0 +1,66 @@
>+use utf8;
>+package Koha::Schema::Result::BorrowerPasswordRecovery;
>+
>+# Created by DBIx::Class::Schema::Loader
>+# DO NOT MODIFY THE FIRST PART OF THIS FILE
>+
>+=head1 NAME
>+
>+Koha::Schema::Result::BorrowerPasswordRecovery
>+
>+=cut
>+
>+use strict;
>+use warnings;
>+
>+use base 'DBIx::Class::Core';
>+
>+=head1 TABLE: C<borrower_password_recovery>
>+
>+=cut
>+
>+__PACKAGE__->table("borrower_password_recovery");
>+
>+=head1 ACCESSORS
>+
>+=head2 borrowernumber
>+
>+  data_type: 'integer'
>+  is_nullable: 0
>+
>+=head2 uuid
>+
>+  data_type: 'varchar'
>+  is_nullable: 0
>+  size: 128
>+
>+=head2 valid_until
>+
>+  data_type: 'timestamp'
>+  datetime_undef_if_invalid: 1
>+  default_value: current_timestamp
>+  is_nullable: 0
>+
>+=cut
>+
>+__PACKAGE__->add_columns(
>+  "borrowernumber",
>+  { data_type => "integer", is_nullable => 0 },
>+  "uuid",
>+  { data_type => "varchar", is_nullable => 0, size => 128 },
>+  "valid_until",
>+  {
>+    data_type => "timestamp",
>+    datetime_undef_if_invalid => 1,
>+    default_value => \"current_timestamp",
>+    is_nullable => 0,
>+  },
>+);
>+
>+
>+# Created by DBIx::Class::Schema::Loader v0.07039 @ 2014-11-03 12:08:20
>+# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:ORAWxUHIkefSfPSqrcfeXA
>+
>+
>+# You can replace this text with custom code or comments, and it will be preserved on regeneration
>+1;
>diff --git a/installer/data/mysql/en/mandatory/sample_notices.sql b/installer/data/mysql/en/mandatory/sample_notices.sql
>index 378be05..f527e37 100644
>--- a/installer/data/mysql/en/mandatory/sample_notices.sql
>+++ b/installer/data/mysql/en/mandatory/sample_notices.sql
>@@ -144,4 +144,8 @@ Your library.'
> );
> 
> INSERT INTO letter(module, code, branchcode, name, title, content, message_transport_type)
>-VALUES ('acquisition', 'ACQ_NOTIF_ON_RECEIV', '', 'Notification on receiving', 'Order received', 'Dear <<borrowers.firstname>> <<borrowers.surname>>,\n\n The order <<aqorders.ordernumber>> (<<biblio.title>>) has been received.\n\nYour library.', 'email')
>+VALUES ('acquisition', 'ACQ_NOTIF_ON_RECEIV', '', 'Notification on receiving', 'Order received', 'Dear <<borrowers.firstname>> <<borrowers.surname>>,\n\n The order <<aqorders.ordernumber>> (<<biblio.title>>) has been received.\n\nYour library.', 'email');
>+
>+INSERT INTO `letter` (module, code, branchcode, name, is_html, title, content, message_transport_type)
>+VALUES ('members','PASSWORD_RESET','','Online password reset',1,'Koha password recovery','<html>\r\n<p>This email has been sent in response to your password recovery request for the account <strong><<user>></strong>.\r\n</p>\r\n<p>\r\nYou can now create your new password using the following link:\r\n<br/><a href=\"<<passwordreseturl>>\"><<passwordreseturl>></a>\r\n</p>\r\n<p>This link will be valid for 2 days from this email\'s reception, then you must reapply if you do not change your password.</p>\r\n<p>Thank you.</p>\r\n</html>\r\n','email'
>+);
>diff --git a/installer/data/mysql/kohastructure.sql b/installer/data/mysql/kohastructure.sql
>index 6ddba43..74e0c60 100644
>--- a/installer/data/mysql/kohastructure.sql
>+++ b/installer/data/mysql/kohastructure.sql
>@@ -3520,6 +3520,17 @@ CREATE TABLE items_search_fields (
>     ON DELETE SET NULL ON UPDATE CASCADE
> ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
> 
>+-- Table structure for table 'borrower_password_recovery'
>+-- this stores the unique ID sent by email to the patron, for future validation
>+--
>+
>+CREATE TABLE IF NOT EXISTS borrower_password_recovery (
>+  borrowernumber int(11) NOT NULL,
>+  uuid varchar(128) NOT NULL,
>+  valid_until timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
>+  KEY borrowernumber (borrowernumber)
>+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
>+
> /*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
> /*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
> /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
>diff --git a/installer/data/mysql/sysprefs.sql b/installer/data/mysql/sysprefs.sql
>index 1e07e3c..bbd397c 100644
>--- a/installer/data/mysql/sysprefs.sql
>+++ b/installer/data/mysql/sysprefs.sql
>@@ -292,6 +292,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
> ('opacreadinghistory','1','','If ON, enables display of Patron Circulation History in OPAC','YesNo'),
> ('OpacRenewalAllowed','0',NULL,'If ON, users can renew their issues directly from their OPAC account','YesNo'),
> ('OpacRenewalBranch','checkoutbranch','itemhomebranch|patronhomebranch|checkoutbranch|null','Choose how the branch for an OPAC renewal is recorded in statistics','Choice'),
>+('OpacResetPassword','1','','Shows the \'Forgot your password?\' link in the OPAC','YesNo'),
> ('OPACResultsSidebar','','70|10','Define HTML to be included on the search results page, underneath the facets sidebar','Textarea'),
> ('OPACSearchForTitleIn','<li><a  href=\"http://worldcat.org/search?q={TITLE}\" target=\"_blank\">Other Libraries (WorldCat)</a></li>\n<li><a href=\"http://www.scholar.google.com/scholar?q={TITLE}\" target=\"_blank\">Other Databases (Google Scholar)</a></li>\n<li><a href=\"http://www.bookfinder.com/search/?author={AUTHOR}&amp;title={TITLE}&amp;st=xl&amp;ac=qr\" target=\"_blank\">Online Stores (Bookfinder.com)</a></li>\n<li><a href=\"http://openlibrary.org/search/?author=({AUTHOR})&title=({TITLE})\" target=\"_blank\">Open Library (openlibrary.org)</a></li>','70|10','Enter the HTML that will appear in the \'Search for this title in\' box on the detail page in the OPAC.  Enter {TITLE}, {AUTHOR}, or {ISBN} in place of their respective variables in the URL. Leave blank to disable \'More Searches\' menu.','Textarea'),
> ('OpacSeparateHoldings','0',NULL,'Separate current branch holdings from other holdings (OPAC)','YesNo'),
>diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl
>index 0592a94..ed76a8f 100755
>--- a/installer/data/mysql/updatedatabase.pl
>+++ b/installer/data/mysql/updatedatabase.pl
>@@ -9971,6 +9971,23 @@ if ( CheckVersion($DBversion) ) {
>     SetVersion($DBversion);
> }
> 
>+$DBversion = "XXX";
>+if ( CheckVersion($DBversion) ) {
>+    $dbh->do("INSERT INTO systempreferences (variable,value,options,explanation,type) VALUES ('OpacResetPassword',  '1','','Shows the ''Forgot your password?'' link in the OPAC','YesNo')");
>+    $dbh->do(q{
>+        CREATE TABLE IF NOT EXISTS borrower_password_recovery (
>+          borrowernumber int(11) NOT NULL,
>+          uuid varchar(128) NOT NULL,
>+          valid_until timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
>+          KEY borrowernumber (borrowernumber)
>+          ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
>+    });
>+    $dbh->do(q{
>+        INSERT INTO `letter` (module, code, branchcode, name, is_html, title, content, message_transport_type) VALUES ('members','PASSWORD_RESET','','Online password reset',1,'Koha password recovery','<html>\r\n<p>This email has been sent in response to your password recovery request for the account <strong><< borrowers.userid>></strong>.\r\n</p>\r\n<p>\r\nYou can now create your new password using the following link:\r\n<br/><a href=\"<<passwordreseturl>>\"><<passwordreseturl>></a>\r\n</p>\r\n<p>This link will be valid for 2 days from this email\'s reception, then you must reapply if you do not change your password.</p>\r\n<p>Thank you.</p>\r\n</html>\r\n','email')
>+        });
>+    print "Upgrade to $DBversion done (Bug 8753: Add forgot password link to OPAC)\n";
>+    SetVersion ($DBversion);
>+}
> 
> # DEVELOPER PROCESS, search for anything to execute in the db_update directory
> # SEE bug 13068
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>index c26d048..83f78eb 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>@@ -339,6 +339,14 @@ OPAC:
>                   no: "Don't allow"
>             - patrons to change their own password on the OPAC. Note that this must be off to use LDAP authentication.
>         -
>+            - "The user "
>+            - pref: OpacResetPassword
>+              default: 1
>+              choices:
>+                  yes: "can reset"
>+                  no: "can not reset"
>+            - " their password on OPAC."
>+        -
>             - pref: OPACPatronDetails
>               choices:
>                   yes: Allow
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
>index aeca007..12efd90 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
>@@ -309,6 +309,9 @@
>                     [% END %]
>                         [% IF PatronSelfRegistration && PatronSelfRegistrationDefaultCategory %]<div id="mpatronregistration"><p>Don't have an account? <a href="/cgi-bin/koha/opac-memberentry.pl">Register here.</a></p></div>[% END %]
>                     </fieldset>
>+                    [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %]
>+                         <p><a href="/cgi-bin/koha/opac-password-recovery.pl">Forgot your password?</  a></p>
>+                    [% END %]
>             </div>
>             <div class="modal-footer">
>                 <input type="submit" class="btn btn-primary" value="Log in" />
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
>index 9ce6ff7..00e7397 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
>@@ -148,6 +148,9 @@
>                                     <input type="text"  size="25" id="userid"  name="userid" />
>                                     <label for="password">Password</label><input type="password"  size="25" id="password"  name="password" />
>                                 </fieldset>
>+                                [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %]
>+                                    <p><a href="/cgi-bin/koha/opac-password-recovery.pl">Forgot your password?</a></p>
>+                                [% END %]
> 
>                                 <input type="submit" value="Log in" class="btn" />
>                                 <div id="nologininstructions">
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
>new file mode 100644
>index 0000000..8dd44aa
>--- /dev/null
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
>@@ -0,0 +1,132 @@
>+[% USE Koha %]
>+[% INCLUDE 'doc-head-open.inc' %]
>+[% IF (LibraryNameTitle) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;
>+[% INCLUDE 'doc-head-close.inc' %]
>+[% BLOCK cssinclude %][% END %]
>+[% BLOCK jsinclude %]
>+<script type="text/javascript" language="javascript">
>+   $(function() {
>+        $("#CheckAll").click(function(){
>+                $("[name=deleteRequest]").attr('checked', true);
>+                return false;
>+            });
>+
>+        $("#CheckNone").click(function(){
>+                $("[name=deleteRequest]").attr('checked', false);
>+                return false;
>+            });
>+
>+        $("select#type").change(function() {
>+            $("fieldset#serial, fieldset#book, fieldset#chapter").hide()
>+            $("fieldset#" + $(this).val() ).show();
>+        });
>+   });
>+</script>
>+[% END %]
>+</head>
>+<body>
>+
>+<div id="doc3" class="yui-t1">
>+    <div id="bd">
>+[% INCLUDE 'masthead.inc' %]
>+        <div id="yui-main">
>+            <div class="yui-b">
>+                <div class="yui-g">
>+                    <div class="illrequest">
>+[% IF (!Koha.Preference('OpacResetPassword')) %]
>+    <div class="dialog alert">You can't reset your password.</div>
>+[% ELSIF (password_recovery) %]
>+    [% IF (hasError) %]
>+        <span class="TxtErreur">
>+        [% IF (sendmailError) %]
>+            An error has occured while sending you the password recovery link.
>+            <br/>Please try again later.
>+        [% ELSIF (errNoEmailFound) %]
>+            No account was found with the email address "<strong>[% email %]</strong>"
>+            <br/>Check if you typed it correctly.
>+        [% ELSIF (errTooManyEmailFound) %]
>+            More than one account has been found for the email address: "<strong>[% email %]</strong>"
>+            <br/>Try to use an alternative email if you have one.
>+        [% ELSIF (errAlreadyStartRecovery) %]
>+            The process of password recovery has already started for this account ("<strong>[% email %]</strong>")
>+            <br/>Check your emails; you should receive the link to reset your password.
>+            <br/>If you did not receive it, <a href="/cgi-bin/koha/opac-password-recovery.pl?resendEmail=true&email=[% email %]">click here to get a new password recovery link</a>
>+        [% END %]
>+        <br/><br/>Please contact the staff if you need further assistance.
>+        </span>
>+    [% END %]
>+        <div id="password-recovery" class="container">
>+            <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post">
>+                <input type="hidden" name="koha_login_context" value="opac" />
>+                <fieldset class="brief">
>+                    <legend>Password recovery form:</legend>
>+                        <p>To reset your password, enter your email address.
>+                        <br/>A link to reset your password will be sent at this address.</p>
>+                        <ol>
>+                            <li><label for="email">Email:</label><input type="text" id="email" size="40" name="email" value="[% email %]" /></li>
>+                        </ol>
>+                    <fieldset class="action">
>+                 <input type="submit" value="Submit" class="submit" name="sendEmail" />
>+                    </fieldset>
>+                 </fieldset>
>+            </form>
>+        </div>
>+
>+[% ELSIF (new_password) %]
>+    [% IF (errLinkNotValid) %]
>+        <span class="TxtErreur"><h6>
>+        We could not authenticate you as the account owner.
>+        <br/>Be sure to use the link you received in your email.
>+        </h6></span>
>+    [% ELSE %]
>+        [% IF (hasError) %]
>+            <span class="TxtErreur">
>+            [% IF (errPassNotMatch) %]
>+                The passwords entered does not match.
>+                <br/>Please try again.
>+            [% ELSIF (errPassTooShort) %]
>+                The password is too short.
>+                <br/>The password must contain at least [% minPassLength %] characters.
>+            [% END %]
>+            </span>
>+        [% END %]
>+            <div id="password-recovery" class="container">
>+                <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post">
>+                    <input type="hidden" name="koha_login_context" value="opac" />
>+                    <fieldset class="brief">
>+                        <legend>Password recovery form:</legend>
>+                            <p class="light">The password must contain at least [% minPassLength %] characters.</p>
>+                            <ol>
>+                                <li><label for="password">New password:</label><input type="password" id="password" size="40" name="password" /></li>
>+                                <li><label for="repeatPassword">Confirm new password:</label><input type="password" id="repeatPassword" size="40" name="repeatPassword" /></li>
>+                            </ol>
>+                        <fieldset class="action">
>+                        <input type="hidden" name="username" value="[% username %]" />
>+                        <input type="hidden" name="uniqueKey" value="[% uniqueKey %]" />
>+                        <input type="submit" value="Submit" class="submit" name="passwordReset" />
>+                        </fieldset>
>+                     </fieldset>
>+                </form>
>+            </div>
>+    [% END %]
>+[% ELSIF (mail_sent) %]
>+    <p>A mail has been sent to "[% email %]".
>+    <br/>It contains a link to create a new password.
>+    <br/>This link will be valid for 2 days starting now.</p>
>+    <br/><a href="/cgi-bin/koha/opac-main.pl"">Click here to return to the main page.</a>
>+[% ELSIF (password_reset_done) %]
>+    <p>The password has been changed for user "[% username %]".
>+    <br/>You can now login using <a href="/cgi-bin/koha/opac-user.pl">this form</a>.</p>
>+[% END %]
>+                    </div>
>+                </div>
>+            </div>
>+        </div>
>+        <div class="yui-b">
>+            <div class="container">
>+                [% INCLUDE 'usermenu.inc' %]
>+            </div>
>+        </div>
>+    </div>
>+[% INCLUDE 'opac-bottom.inc' %]
>+</div>
>diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl
>new file mode 100755
>index 0000000..b5cd2c2
>--- /dev/null
>+++ b/opac/opac-password-recovery.pl
>@@ -0,0 +1,156 @@
>+#!/usr/bin/perl
>+
>+use strict;
>+use Modern::Perl;
>+use CGI;
>+
>+use C4::Auth;
>+use C4::Koha;
>+use C4::Members qw(changepassword GetMember GetMemberDetails );
>+use C4::Output;
>+use C4::Context;
>+use C4::Passwordrecovery qw(SendPasswordRecoveryEmail ValidateBorrowernumber GetValidLinkInfo);
>+use Koha::AuthUtils qw(hash_password);
>+my $query = new CGI;
>+use HTML::Entities;
>+
>+my ( $template, $dummy, $cookie ) = get_template_and_user(
>+    {
>+        template_name   => "opac-password-recovery.tt",
>+        query           => $query,
>+        type            => "opac",
>+        authnotrequired => 1,
>+        debug           => 1,
>+    }
>+);
>+
>+my $email          = $query->param('email') // q{};
>+my $password       = $query->param('password');
>+my $repeatPassword = $query->param('repeatPassword');
>+my $minPassLength  = C4::Context->preference('minPasswordLength');
>+my $id             = $query->param('id');
>+my $uniqueKey      = $query->param('uniqueKey');
>+my $username       = $query->param('username');
>+my $borrower_number;
>+
>+#errors
>+my $hasError;
>+
>+#email form error
>+my $errNoEmailFound;
>+my $errAlreadyStartRecovery;
>+
>+#new password form error
>+my $errLinkNotValid;
>+my $errPassNotMatch;
>+my $errPassTooShort;
>+
>+if ( $query->param('sendEmail') || $query->param('resendEmail') ) {
>+    my $protocol = $query->https() ? "https://" : "http://";
>+    #try with the main email
>+    $email ||= ''; # avoid undef
>+    my $borrower_infos = GetMember( email => $email );
>+    $borrower_infos = GetMember( emailpro => $email ) unless $borrower_infos;
>+    $borrower_infos = GetMember( B_email => $email ) unless $borrower_infos;
>+    if($borrower_infos) {
>+        $borrower_number = $borrower_infos->{'borrowernumber'};
>+    }
>+
>+    if ( !$email || !$borrower_number ) {
>+        $hasError        = 1;
>+        $errNoEmailFound = 1;
>+    }
>+    elsif ( !$query->param('resendEmail') ) {
>+        my $already = ValidateBorrowernumber( $borrower_number );
>+
>+        if ( $already ) {
>+            $hasError                = 1;
>+            $errAlreadyStartRecovery = 1;
>+        }
>+    }
>+
>+    if ($hasError) {
>+        $template->param(
>+            hasError                => 1,
>+            errNoEmailFound         => $errNoEmailFound,
>+            errAlreadyStartRecovery => $errAlreadyStartRecovery,
>+            password_recovery       => 1,
>+            email                   => HTML::Entities::encode($email),
>+        );
>+    }
>+    elsif ( SendPasswordRecoveryEmail( $borrower_infos, $email, $protocol, $query->param('resendEmail') ) ) {#generate uuid and send recovery email
>+        $template->param(
>+            mail_sent => 1,
>+            email     => $email
>+        );
>+    }
>+    else {# if it doesnt work....
>+        $template->param(
>+            password_recovery => 1,
>+            sendmailError     => 1
>+        );
>+    }
>+}
>+elsif ( $query->param('passwordReset') ) {
>+    ( $borrower_number, $username ) = GetValidLinkInfo($uniqueKey);
>+    #validate password length & match
>+    if (   ($borrower_number)
>+        && ( $password eq $repeatPassword )
>+        && ( length($password) >= $minPassLength ) )
>+    {  #apply changes
>+        changepassword( $username, $borrower_number, hash_password($password) );
>+
>+        #remove entry
>+        my $schema = Koha::Database->new->schema;
>+        my $rs = $schema->resultset('BorrowerPasswordRecovery')->search({-or => [uuid => $uniqueKey, valid_until => \'< NOW()']});
>+        $rs->delete;
>+
>+        $template->param(
>+            password_reset_done => 1,
>+            username            => $username
>+        );
>+    }
>+    else { #errors
>+        if ( !$borrower_number ) { #parameters not valid
>+            $errLinkNotValid = 1;
>+        }
>+        elsif ( $password ne $repeatPassword ) { #passwords does not match
>+            $errPassNotMatch = 1;
>+        }
>+        elsif ( length($password) < $minPassLength ) { #password too short
>+            $errPassTooShort = 1;
>+        }
>+        $template->param(
>+            new_password    => 1,
>+            minPassLength   => $minPassLength,
>+            email           => $email,
>+            uniqueKey       => $uniqueKey,
>+            errLinkNotValid => $errLinkNotValid,
>+            errPassNotMatch => $errPassNotMatch,
>+            errPassTooShort => $errPassTooShort,
>+            hasError        => 1
>+        );
>+    }
>+}
>+elsif ($uniqueKey) {  #reset password form
>+    #check if the link is valid
>+    ( $borrower_number, $username ) = GetValidLinkInfo($uniqueKey);
>+
>+    if ( !$borrower_number ) {
>+        $errLinkNotValid = 1;
>+    }
>+
>+    $template->param(
>+        new_password    => 1,
>+        minPassLength   => $minPassLength,
>+        email           => $email,
>+        uniqueKey       => $uniqueKey,
>+        username        => $username,
>+        errLinkNotValid => $errLinkNotValid
>+    );
>+}
>+else { #password recovery form (to send email)
>+    $template->param( password_recovery => 1 );
>+}
>+
>+output_html_with_http_headers $query, $cookie, $template->output;
>-- 
>2.1.0

Actions: View | Diff | Splinter Review

Attachments on bug 13068: 32173 | 32174 | 32175 | 32177 | 32178 | 32179 | 32180 | 32185 | 32294 | 32300 | 32398 | 32399 | 32525 | 32526 | 32658 | 32659 | 32784 | 32785 | 32839 | 32840 | 32841 | 32842 | 32843 | 32919 | 32921 | 33859 | 34070 | 34071 | 34072 | 34949 | 34950 | 34951 | 34960 | 34998 | 35000 | 35001 | 35002 | 35003 | 35366 | 35367 | 35368 | 35370 | 36716 | 36717 | 36718 | 36719 | 36779 | 36780 | 36781 | 36792 | 37061 | 37062 | 37063 | 37064 | 37065 | 37066 | 37075 | 37076 | 37491