View | Details | Raw Unified | Return to bug 17006
Collapse All | Expand All

(-)a/Koha/REST/V1/Patron.pm (-1 / +3 lines)
Lines 20-25 use Modern::Perl; Link Here
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
use C4::Auth qw( haspermission checkpw_internal );
22
use C4::Auth qw( haspermission checkpw_internal );
23
use C4::Context;
23
use Koha::Patrons;
24
use Koha::Patrons;
24
25
25
sub list {
26
sub list {
Lines 60-67 sub changepassword { Link Here
60
61
61
    my $user = $c->stash('koha.user');
62
    my $user = $c->stash('koha.user');
62
    my $patron = Koha::Patrons->find($args->{borrowernumber});
63
    my $patron = Koha::Patrons->find($args->{borrowernumber});
64
    my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange");
63
    unless ( $user
65
    unless ( $user
64
        && ( $user->borrowernumber == $args->{borrowernumber}
66
        && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber})
65
            || haspermission($user->userid, {borrowers => 1}) ) )
67
            || haspermission($user->userid, {borrowers => 1}) ) )
66
    {
68
    {
67
        return $c->$cb({ error => "You don't have the required permission" }, 403);
69
        return $c->$cb({ error => "You don't have the required permission" }, 403);
(-)a/t/db_dependent/api/v1/patrons.t (-2 / +26 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 26;
20
use Test::More tests => 30;
21
use Test::Mojo;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
22
use t::lib::TestBuilder;
23
use t::lib::Mocks;
23
use t::lib::Mocks;
Lines 45-50 my $borrower = $builder->build({ Link Here
45
    value => {
45
    value => {
46
        branchcode   => $branchcode,
46
        branchcode   => $branchcode,
47
        categorycode => $categorycode,
47
        categorycode => $categorycode,
48
        flags        => 0,
49
        password     => Koha::AuthUtils::hash_password($password),
48
    }
50
    }
49
});
51
});
50
52
Lines 83-88 $session->param('ip', '127.0.0.1'); Link Here
83
$session->param('lasttime', time());
85
$session->param('lasttime', time());
84
$session->flush;
86
$session->flush;
85
87
88
my $session_nopermission = C4::Auth::get_session('');
89
$session_nopermission->param('number', $borrower->{ borrowernumber });
90
$session_nopermission->param('id', $borrower->{ userid });
91
$session_nopermission->param('ip', '127.0.0.1');
92
$session_nopermission->param('lasttime', time());
93
$session_nopermission->flush;
94
86
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
95
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
87
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
96
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
88
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
97
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
Lines 125-128 $t->request_ok($tx) Link Here
125
  ->status_is(400)
134
  ->status_is(400)
126
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
135
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
127
136
137
$password_obj = {
138
    current_password    => $password,
139
    new_password        => "new password",
140
};
141
t::lib::Mocks::mock_preference("OpacPasswordChange", 0);
142
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
143
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
144
$t->request_ok($tx)
145
  ->status_is(403);
146
147
t::lib::Mocks::mock_preference("OpacPasswordChange", 1);
148
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
149
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
150
$t->request_ok($tx)
151
  ->status_is(200);
152
128
$schema->storage->txn_rollback;
153
$schema->storage->txn_rollback;
129
- 

Return to bug 17006