Bugzilla – Attachment 82627 Details for
Bug 17006
Add route to change patron's password (authenticated)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17006: Add /patrons/{patron_id}/password
Bug-17006-Add-patronspatronidpassword.patch (text/plain), 5.31 KB, created by
Tomás Cohen Arazi (tcohen)
on 2018-11-24 12:42:43 UTC
(
hide
)
Description:
Bug 17006: Add /patrons/{patron_id}/password
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2018-11-24 12:42:43 UTC
Size:
5.31 KB
patch
obsolete
>From 4d72b0beff0fe45fd0f9a68863a327cc973f93b0 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Thu, 16 Aug 2018 07:02:17 -0300 >Subject: [PATCH] Bug 17006: Add /patrons/{patron_id}/password > >This patch introduces an endpoint for changing a patron's password. >To test: > >- Apply this patchset >- Run: > $ kshell > k$ prove t/db_dependent/api/v1/patrons_password.t >=> SUCCESS: tests pass! >- Play with the different use cases highlighted by the tests, on your >favourite REST testing tool (Postman, RESTer on FF, etc). > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> > >Signed-off-by: Josef Moravec <josef.moravec@gmail.com> >--- > Koha/REST/V1/Patrons/Password.pm | 123 +++++++++++++++++++++++++++++++ > 1 file changed, 123 insertions(+) > create mode 100644 Koha/REST/V1/Patrons/Password.pm > >diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm >new file mode 100644 >index 0000000000..35f51dd26b >--- /dev/null >+++ b/Koha/REST/V1/Patrons/Password.pm >@@ -0,0 +1,123 @@ >+package Koha::REST::V1::Patrons::Password; >+ >+# This file is part of Koha. >+# >+# Koha is free software; you can redistribute it and/or modify it under the >+# terms of the GNU General Public License as published by the Free Software >+# Foundation; either version 3 of the License, or (at your option) any later >+# version. >+# >+# Koha is distributed in the hope that it will be useful, but WITHOUT ANY >+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR >+# A PARTICULAR PURPOSE. See the GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License along >+# with Koha; if not, write to the Free Software Foundation, Inc., >+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. >+ >+use Modern::Perl; >+ >+use Mojo::Base 'Mojolicious::Controller'; >+ >+use Koha::Exceptions::Password; >+use Koha::Patrons; >+ >+use C4::Auth qw(checkpw_internal); >+ >+use Scalar::Util qw(blessed); >+use Try::Tiny; >+ >+=head1 NAME >+ >+Koha::REST::V1::Patrons::Password >+ >+=head1 API >+ >+=head2 Methods >+ >+=head3 set >+ >+Controller method that sets a patron's password >+ >+=cut >+ >+sub set { >+ my $c = shift->openapi->valid_input or return; >+ >+ my $patron = Koha::Patrons->find( $c->validation->param('patron_id') ); >+ my $body = $c->validation->param('body'); >+ >+ unless ($patron) { >+ return $c->render( status => 404, openapi => { error => "Patron not found." } ); >+ } >+ >+ return try { >+ >+ my $password = $body->{ password }; >+ my $old_password = $body->{ old_password }; >+ >+ ## Check if the patron is changing its own un-privileged account >+ # Required permissions >+ # TODO: Get rid of this once bug 21198 is implemented and integrated >+ my $permissions >+ = $c->match >+ ->endpoint >+ ->pattern >+ ->defaults >+ ->{'openapi.op_spec'} >+ ->{'x-koha-authorization'} >+ ->{'permissions'}; >+ >+ my $user = $c->stash('koha.user'); >+ >+ if ( !$user->has_permission( $permissions ) ) { >+ # Doesn't have permissions, it reached here because it is >+ # the user changing its own password, validate the provided password! >+ if ( C4::Context->preference('OpacPasswordChange') ) { >+ # self password change allowed, validate >+ my $dbh = C4::Context->dbh; >+ # test old_password is valid >+ unless ( checkpw_internal($dbh, $patron->userid, $old_password ) ) { >+ Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password"); >+ } >+ } >+ else { >+ # self password change not allowed >+ Koha::Exceptions::Authorization::Unauthorized->throw("Configuration prevents password changes by unauthorized users"); >+ } >+ } >+ >+ ## Change password >+ # TODO: Use $patron->set_password when bug 21178 is pushed >+ my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password ); >+ if ( !$is_valid ) { >+ if ( $error eq 'too_short' ) { >+ my $min_length = C4::Context->preference('minPasswordLength'); >+ $min_length = 3 if not $min_length or $min_length < 3; >+ >+ my $password_length = length($password) // 0; >+ Koha::Exceptions::Password::TooShort->throw( >+ length => $password_length, min_length => $min_length ); >+ } >+ elsif ( $error eq 'has_whitespaces' ) { >+ Koha::Exceptions::Password::TrailingWhitespaces->throw( >+ "Password contains trailing spaces, which is forbidden."); >+ } >+ elsif ( $error eq 'too_weak' ) { >+ Koha::Exceptions::Password::TooWeak->throw("Password is too weak"); >+ } >+ } >+ >+ $patron->update_password( $patron->userid, $password ); >+ return $c->render( status => 200, openapi => "" ); >+ } >+ catch { >+ unless ( blessed $_ && $_->can('rethrow') ) { >+ return $c->render( status => 500, openapi => { error => "$_" } ); >+ } >+ # an exception was raised. return 400 with the stringified exception >+ return $c->render( status => 400, openapi => { error => "$_" } ); >+ }; >+} >+ >+1; >-- >2.19.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17006
:
54575
|
54576
|
54629
|
54630
|
54716
|
54717
|
54718
|
56155
|
56156
|
56157
|
56158
|
56283
|
56284
|
56399
|
56400
|
56401
|
56409
|
57356
|
57357
|
57358
|
57359
|
57360
|
63329
|
63330
|
63331
|
63332
|
63333
|
67128
|
67129
|
67130
|
67131
|
67132
|
70260
|
70261
|
70262
|
70263
|
70264
|
77882
|
77883
|
77884
|
77923
|
77924
|
77925
|
78837
|
82625
|
82626
|
82627
|
82628
|
83579
|
83580
|
83581
|
83749
|
83750
|
83751
|
84285
|
84286
|
84287
|
84488