From e26b5f531709c17ec3783e057209f559551f8aa6 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 3 Mar 2022 12:03:42 +0000 Subject: [PATCH] Bug 25936: Add option to send password change notices This patch add a new security notice to allow sending notification of password changes to patrons. If enabled, the 'PASSCHANGE' notice will be sent to respective patrons whenever their password is updated. Test plan 1) Run the database updates 2) Enable the new feature by setting 'NotifyPasswordChange' to 'Notify' 3) Change a users password 4) Check that the notice appears in the patrons notices --- Koha/Patron.pm | 38 ++++++++++++++++++- .../data/mysql/atomicupdate/bug_25936.pl | 27 +++++++++++++ .../mysql/en/mandatory/sample_notices.yml | 15 ++++++++ installer/data/mysql/mandatory/sysprefs.sql | 1 + .../en/modules/admin/preferences/patrons.pref | 6 +++ 5 files changed, 86 insertions(+), 1 deletion(-) create mode 100755 installer/data/mysql/atomicupdate/bug_25936.pl diff --git a/Koha/Patron.pm b/Koha/Patron.pm index 9968d36350..d8197e5ba6 100644 --- a/Koha/Patron.pm +++ b/Koha/Patron.pm @@ -25,10 +25,11 @@ use JSON qw( to_json ); use Unicode::Normalize qw( NFKD ); use C4::Context; +use C4::Auth qw( checkpw_hash ); use C4::Log qw( logaction ); use Koha::Account; use Koha::ArticleRequests; -use C4::Letters; +use C4::Letters qw( GetPreparedLetter EnqueueLetter SendQueuedMessages ); use Koha::AuthUtils; use Koha::Checkouts; use Koha::CirculationRules; @@ -875,6 +876,41 @@ sub set_password { } } + if ( C4::Context->preference('NotifyPasswordChange') ) { + my $self_from_storage = $self->get_from_storage; + if ( !C4::Auth::checkpw_hash( $password, $self_from_storage->password ) ) { + my $emailaddr = $self_from_storage->notice_email_address; + + # if we manage to find a valid email address, send notice + if ($emailaddr) { + eval { + my $letter = GetPreparedLetter( + module => 'members', + letter_code => 'PASSCHANGE', + branchcode => $self_from_storage->branchcode, + , + lang => $self_from_storage->lang || 'default', + tables => { + 'branches' => $self_from_storage->branchcode, + 'borrowers' => $self_from_storage->borrowernumber, + }, + want_librarian => 1, + ) or return; + + my $message_id = EnqueueLetter( + { + letter => $letter, + borrowernumber => $self_from_storage->id, + to_address => $emailaddr, + message_transport_type => 'email' + } + ); + SendQueuedMessages( { message_id => $message_id } ); + }; + } + } + } + my $digest = Koha::AuthUtils::hash_password($password); # We do not want to call $self->store and retrieve password from DB diff --git a/installer/data/mysql/atomicupdate/bug_25936.pl b/installer/data/mysql/atomicupdate/bug_25936.pl new file mode 100755 index 0000000000..ded356bc6b --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_25936.pl @@ -0,0 +1,27 @@ +use Modern::Perl; + +return { + bug_number => "25936", + description => "A password change notification feature", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + # Add PASSCHANGE notice + $dbh->do( q{ + INSERT IGNORE INTO letter (module, code, name, title, content, message_transport_type) VALUES ('members', 'PASSCHANGE', 'Notification of password change', 'Library account password change notification', + "Dear [% borrower.firstname %] [% borrower.surname %], + + Someone has changed your library user account password. + + If this is unexpected, please contact the library. + ", 'email'); + }); + + # Add systempreference + $dbh->do(q{ + INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) + VALUES ('NotifyPasswordChange','0','','Notify patrons whenever their password is changed.','YesNo') + }); + }, +}; diff --git a/installer/data/mysql/en/mandatory/sample_notices.yml b/installer/data/mysql/en/mandatory/sample_notices.yml index ffcb4cb5d4..d54b24c330 100644 --- a/installer/data/mysql/en/mandatory/sample_notices.yml +++ b/installer/data/mysql/en/mandatory/sample_notices.yml @@ -1024,6 +1024,21 @@ tables: - "" - "If you did not initiate this request, you may safely ignore this one-time message. The request will expire shortly." + - module: members + code: PASSCHANGE + branchcode: "" + name: "Notification of password change" + is_html: 1 + title: "Library account password change notification for [% patron.firstname %] [% patron.surname %]" + message_transport_type: email + lang: default + content: + - "Dear [% patron.firstname %] [% patron.surname %]," + - "" + - "Someone has changed your library user account password." + - "" + - "If this is unexpected, please contact the library" + - module: members code: PASSWORD_RESET branchcode: "" diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql index dd83a00fd8..f79e7d4169 100644 --- a/installer/data/mysql/mandatory/sysprefs.sql +++ b/installer/data/mysql/mandatory/sysprefs.sql @@ -365,6 +365,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('NoticeCSS','',NULL,'Notices CSS url.','free'), ('NoticesLog','0',NULL,'If enabled, log changes to notice templates','YesNo'), ('NotifyBorrowerDeparture','30',NULL,'Define number of days before expiry where circulation is warned about patron account expiry','Integer'), +('NotifyPasswordChange','0',NULL,'Notify patrons whenever their password is changed.','YesNo'), ('NovelistSelectEnabled','0',NULL,'Enable Novelist Select content. Requires Novelist Profile and Password','YesNo'), ('NovelistSelectPassword','',NULL,'Novelist select user Password','free'), ('NovelistSelectProfile','',NULL,'Novelist Select user Profile','free'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref index 9ef410f24c..6a7294132b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref @@ -148,6 +148,12 @@ Patrons: 1: Send 0: "Don't send" - an email to newly created patrons with their account details. + - + - pref: NotifyPasswordChange + choices: + 1: Notify + 0: "Don't notify" + - patrons whenever their password is changed. - - pref: UseEmailReceipts choices: -- 2.20.1