From 310b4502b17b301216a99b451021fd2115d8a282 Mon Sep 17 00:00:00 2001 From: Jake Deery Date: Thu, 12 Feb 2026 10:22:47 +0000 Subject: [PATCH] Bug 41132: Add branch and borrower to PASSWORD_RESET This patch adds sanitised borrower - and branch - objects to the PASSWORD_RESET email template. This allows TemplateToolkit access, as well as richer logic options for branches that want greater email customisation. Prior to testing (k.t.d): a) enter k.t.d with: ktd --shell b) sudo apt update && sudo apt install dialog -y c) sudo apt install exim4 -y d) sudo dpkg-reconfigure exim4-config *) press enter to accept all defaults To test: == APPLY PATCH == a) reset_all b) on the staff client, go to /cgi-bin/koha/tools/letter.pl?op=add_form&branchcode=&module=members&code=PASSWORD_RESET c) under email, inspect the notice. see how it is now a tt notice, with borrower and branch attributes d) go to /cgi-bin/koha/members/memberentry.pl?op=edit_form&borrowernumber=51 e) under contact information, edit the primary email to be: root@localhost - save f) go to /cgi-bin/koha/admin/preferences.pl?op=search&searchfield=OpacResetPassword&ok=Search *) set OpacResetPassword to allowed g) on the opac, go to /cgi-bin/koha/opac-password-recovery.pl *) remember to log out *) enter 42 as the cardnumber, root@localhost as the email - submit h) on the staff client, go to /cgi-bin/koha/members/notices.pl?borrowernumber=51 *) remember to log back in *) click the most recent koha password recovery notice i) observe how the notice contains the borrower's name, userid, as well as the branch name and (data-dependent) email address j) go to /cgi-bin/koha/tools/letter.pl?op=add_form&branchcode=&module=members&code=PASSWORD_RESET k) edit the notice text, and add [% borrower.password %] at the end l) repeat steps g-h, possibly needing to additionally click get new password recovery link m) observe how the notice is unchanged from step i), and the password is not exposed == SIGN OFF == Signed-off-by: David Nind --- Koha/Patron/Password/Recovery.pm | 9 ++++++++- installer/data/mysql/en/mandatory/sample_notices.yml | 12 ++++++++---- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/Koha/Patron/Password/Recovery.pm b/Koha/Patron/Password/Recovery.pm index 99cf817d1a..1ee2ef88fc 100644 --- a/Koha/Patron/Password/Recovery.pm +++ b/Koha/Patron/Password/Recovery.pm @@ -131,6 +131,12 @@ sub SendPasswordRecoveryEmail { my $opacbase = C4::Context->preference('OPACBaseURL') || ''; my $uuidLink = $opacbase . "/cgi-bin/koha/opac-password-recovery.pl?uniqueKey=$uuid_str"; + # create a sanitised borrower hash + my $user = $borrower->unblessed; + my $library = $borrower->library; + $user->{branchname} = $library ? $library->branchname : ''; + delete $user->{password}; + # prepare the email my $letter = C4::Letters::GetPreparedLetter( module => 'members', @@ -138,10 +144,11 @@ sub SendPasswordRecoveryEmail { branchcode => $borrower->branchcode, lang => $borrower->lang, substitute => { passwordreseturl => $uuidLink, user => $borrower->userid }, + tables => { branches => $borrower->branchcode }, + objects => { borrower => $user }, ); # define from emails - my $library = $borrower->library; my $kohaEmail = $library->from_email_address; # send from patron's branch or Koha Admin my $message_id = C4::Letters::EnqueueLetter( diff --git a/installer/data/mysql/en/mandatory/sample_notices.yml b/installer/data/mysql/en/mandatory/sample_notices.yml index 69ff86f532..a89ec37658 100644 --- a/installer/data/mysql/en/mandatory/sample_notices.yml +++ b/installer/data/mysql/en/mandatory/sample_notices.yml @@ -1548,14 +1548,18 @@ tables: message_transport_type: email lang: default content: - - "

This email has been sent in response to your password recovery request for the account <>." - - "

" + - "

Dear [% borrower.firstname %] [% borrower.surname %]

" + - "

This email has been sent in response to your password recovery request for the account [% borrower.userid %].

" - "

" - - "You can now create your new password using the following link:" - - "
>\"><>" + - "You can now create your new password using the following link:
" + - "[% passwordreseturl %]" - "

" - "

This link will be valid for 2 days from this email's reception, then you must reapply if you do not change your password.

" - "

Thank you.

" + - "

" + - "[% branch.branchname %]
" + - "[% branch.branchemail %]" + - "

" - module: members code: STAFF_PASSWORD_RESET -- 2.39.5