From 22992b1aa899478f7380d5b2f06d6626703592fd Mon Sep 17 00:00:00 2001 From: Matt Blenkinsop Date: Wed, 6 Dec 2023 10:03:45 +0000 Subject: [PATCH] Bug 35204: Prevent an expired password from throwing a 500 error Currently when a patron with an expired password is authenticated via the API a 500 error is returned rather than a 400 "Validation failed" error. This patch catches the return value for an expired password and returns the validation failure before the patron search is attempted. Test plan: 1) Choose a patron and set their password expiry date to a date in the past 2) Send a request to auth/password/validation with that patron's details 3) The response should be a 500 error 4) Apply patch 5) Repeat steps 1-3 and this time the response should be a 400 code with an error message of "Validation failed" --- Koha/REST/V1/Auth/Password.pm | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Koha/REST/V1/Auth/Password.pm b/Koha/REST/V1/Auth/Password.pm index 4369ffd187..1a21bb9181 100644 --- a/Koha/REST/V1/Auth/Password.pm +++ b/Koha/REST/V1/Auth/Password.pm @@ -79,6 +79,13 @@ sub validate { ); } + # An expired password returns an undefined value for $THE_cardnumber so no patron can be found. + # The API returns a 500 error instead of a failed validation + return $c->render( + status => 400, + openapi => { error => "Validation failed" } + ) if $status == -2; + my $patron = Koha::Patrons->find( { cardnumber => $THE_cardnumber } ); return $c->render( -- 2.37.1 (Apple Git-137.1)