@@ -, +, @@ constraints $ kshell k$ prove t/db_dependent/api/v1/patrons_password.t 403. --- Koha/REST/V1/Patrons/Password.pm | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/Koha/REST/V1/Patrons/Password.pm +++ a/Koha/REST/V1/Patrons/Password.pm @@ -90,6 +90,7 @@ sub set_public { my $body = $c->validation->param('body'); my $patron_id = $c->validation->param('patron_id'); + # short-circuit early unless ( C4::Context->preference('OpacPasswordChange') ) { return $c->render( status => 403, @@ -108,6 +109,15 @@ sub set_public { ); } + unless ( $user->category->effective_change_password ) { + return $c->render( + status => 403, + openapi => { + error => "Changing password is forbidden" + } + ); + } + my $old_password = $body->{old_password}; my $password = $body->{password}; my $password_2 = $body->{password_repeated}; --