From 2a6d4786f38e9d16564f8f4e668cb24e80317de4 Mon Sep 17 00:00:00 2001 From: Arthur Suzuki Date: Fri, 20 Dec 2019 18:00:28 +0100 Subject: [PATCH] Bug 23011: Have AuthenticatePatron method send more information We want AuthenticatePatron to send some more information upon successful login, especially in the case where password is not safe and should be renewed. The goal is to let a third-party app catch thoses codes and display a warning to the users. Test plan : 1 / apply tests patch 2 / run tests, verify failure 3 / apply C4/ILSDI/Service.pm patch 4 / run tests again, verify green Signed-off-by: Emmi Takkinen --- C4/ILSDI/Services.pm | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/C4/ILSDI/Services.pm b/C4/ILSDI/Services.pm index 5ebba3435d..42c036cc3c 100644 --- a/C4/ILSDI/Services.pm +++ b/C4/ILSDI/Services.pm @@ -368,14 +368,24 @@ sub AuthenticatePatron { my $username = $cgi->param('username'); my $password = $cgi->param('password'); my ($status, $cardnumber, $userid) = C4::Auth::checkpw( C4::Context->dbh, $username, $password ); - if ( $status ) { - # Get the borrower - my $patron = Koha::Patrons->find( { userid => $userid } ); - return { id => $patron->borrowernumber }; - } - else { - return { code => 'PatronNotFound' }; + + return { code => 'PatronNotFound' } unless( $status ); + + # Get the borrower + my $patron = Koha::Patrons->find( { userid => $userid } ); + my $response->{id} = $patron->borrowernumber; + # Check passwd complexity against rules + my ($is_valid, $error) = Koha::AuthUtils::is_password_valid( $password ); + + unless( $is_valid ) { + $response->{code} = 'PatronPasswordNotSecure'; + $response->{securePasswordLabel} = $error; + my $minPasswordLength = C4::Context->preference('minPasswordLength'); + $response->{securePasswordPattern} = '.{'.$minPasswordLength.'}' if( $error eq 'too_short'); + $response->{securePasswordPattern} = '(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{'.$minPasswordLength.'}' if( $error eq 'too_weak'); } + + return $response; } =head2 GetPatronInfo -- 2.11.0