From 06e7ba7179c2cfe375ba30033203ac6da90a16b6 Mon Sep 17 00:00:00 2001 From: Aleisha Amohia Date: Fri, 6 May 2022 02:04:35 +0000 Subject: [PATCH] Bug 30700: Allow staff users to change their password via staff client Patrons who can log into the staff client (have the 'catalogue' permission) should be able to change their own password. To test: 1) Create a user with only 'catalogue' permissions (Patron A) 2) Log in to the staff client as Patron A 3) Click the menu with your username in the top-right of the window. Click the 'your account' menu link. 4) Confirm you are forced to a login screen, so you cannot view your account, which is where the 'change password' link is normally found. 5) Try to access the page to change your password directly http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X (swap Patron A's borrowernumber in). Confirm you are forced to a login screen. 6) Apply this patch and restart services. Go back to the mainpage logged in as Patron A. 7) Click the menu with your username in the top-right of the window. Notice there is now a 'Change password' menu link. Go to 'change password'. 8) Confirm you are now shown a page to change your password. Change your password, and confirm you are redirect to the mainpage. 9) Try to access the page to change someone else's page directly http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=X (swap some other borrowernumber in). Confirm you are redirected to a 404. 10) Log out and log back in as your original borrower. Confirm you are able to change your password as normal. Sponsored-by: Education Services Australia SCIS Signed-off-by: David Nind --- .../intranet-tmpl/prog/en/includes/header.inc | 5 +++++ .../prog/en/includes/members-toolbar.inc | 4 +++- members/member-password.pl | 18 +++++++++++++++--- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc index 754ac0d294..2e4fbb6ba9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc @@ -192,6 +192,11 @@ My checkouts [% END %] + +
  • + Change password +
    • +
  • Log out
    • diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc index 0466779a60..adcc1d982a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -13,9 +13,11 @@ [% IF patron.is_adult AND Koha.Preference("borrowerRelationship") %] Add guarantee [% END %] - Change password Duplicate [% END %] + [% IF CAN_user_borrowers_edit_borrowers || patron.borrowernumber == logged_in_user.borrowernumber %] + Change password + [% END %] [% IF CAN_user_circulate_circulate_remaining_permissions %]
    diff --git a/members/member-password.pl b/members/member-password.pl index d44f29d0f7..40adcfb0fc 100755 --- a/members/member-password.pl +++ b/members/member-password.pl @@ -28,11 +28,19 @@ my ( $template, $loggedinuser, $cookie, $staffflags ) = get_template_and_user( template_name => "members/member-password.tt", query => $input, type => "intranet", - flagsrequired => { borrowers => 'edit_borrowers' }, + flagsrequired => { catalogue => 1 }, } ); my $patron_id = $input->param('member'); +my $logged_in_user = Koha::Patrons->find( $loggedinuser ); + +if ( !$logged_in_user->has_permission({ borrowers => 'edit_borrowers' }) and $loggedinuser != $patron_id ) { + print $input->redirect("/cgi-bin/koha/errors/404.pl"); + +} else { +# patron has permission to edit other borrowers, or is changing their own password + my $destination = $input->param('destination'); my $newpassword = $input->param('newpassword'); my $newpassword2 = $input->param('newpassword2'); @@ -40,7 +48,6 @@ my $new_user_id = $input->param('newuserid'); my @errors; -my $logged_in_user = Koha::Patrons->find( $loggedinuser ); my $patron = Koha::Patrons->find( $patron_id ); output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); @@ -68,7 +75,10 @@ if ( $newpassword and not @errors) { $patron->userid($new_user_id)->store if $new_user_id and $new_user_id ne $patron->userid; $template->param( newpassword => $newpassword ); - if ( $destination eq 'circ' ) { + if ( !$patron->has_permission({ borrowers => 'edit_borrowers' }) ) { + print $input->redirect("/cgi-bin/koha/mainpage.pl"); + } + elsif ( $destination eq 'circ' ) { print $input->redirect("/cgi-bin/koha/circ/circulation.pl?findborrower=" . $patron->cardnumber); } else { @@ -107,4 +117,6 @@ if ( scalar(@errors) ) { } } +} # patron has permission to edit other borrowers, or is changing their own password + output_html_with_http_headers $input, $cookie, $template->output; -- 2.30.2