View | Details | Raw Unified | Return to bug 17006
Collapse All | Expand All

(-)a/Koha/REST/V1/Patron.pm (-1 / +9 lines)
Lines 19-26 use Modern::Perl; Link Here
19
19
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
23
use C4::Auth qw( haspermission checkpw_internal );
22
use C4::Auth qw( haspermission checkpw_internal );
23
use C4::Context;
24
use Koha::Patrons;
24
use Koha::Patrons;
25
25
26
sub list {
26
sub list {
Lines 51-56 sub changepassword { Link Here
51
51
52
    my $user = $c->stash('koha.user');
52
    my $user = $c->stash('koha.user');
53
    my $patron = Koha::Patrons->find($args->{borrowernumber});
53
    my $patron = Koha::Patrons->find($args->{borrowernumber});
54
55
    my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange");
56
    unless ( $user
57
        && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber})
58
            || haspermission($user->userid, {borrowers => 1}) ) )
59
    {
60
        return $c->$cb({ error => "OPAC password change is disabled" }, 403);
61
    }
54
    return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
62
    return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
55
63
56
    my $pw = $args->{'body'};
64
    my $pw = $args->{'body'};
(-)a/t/db_dependent/api/v1/patrons.t (-2 / +27 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 38;
20
21
use Test::More tests => 43;
21
use Test::Mojo;
22
use Test::Mojo;
22
use t::lib::TestBuilder;
23
use t::lib::TestBuilder;
23
use t::lib::Mocks;
24
use t::lib::Mocks;
Lines 57-62 my $borrower = $builder->build({ Link Here
57
        categorycode => $categorycode,
58
        categorycode => $categorycode,
58
        flags        => 0,
59
        flags        => 0,
59
        guarantorid    => $guarantor->{borrowernumber},
60
        guarantorid    => $guarantor->{borrowernumber},
61
        password     => Koha::AuthUtils::hash_password($password),
60
    }
62
    }
61
});
63
});
62
64
Lines 141-146 $session->param('ip', '127.0.0.1'); Link Here
141
$session->param('lasttime', time());
143
$session->param('lasttime', time());
142
$session->flush;
144
$session->flush;
143
145
146
my $session_nopermission = C4::Auth::get_session('');
147
$session_nopermission->param('number', $borrower->{ borrowernumber });
148
$session_nopermission->param('id', $borrower->{ userid });
149
$session_nopermission->param('ip', '127.0.0.1');
150
$session_nopermission->param('lasttime', time());
151
$session_nopermission->flush;
152
144
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
153
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
145
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
154
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
146
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
155
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
Lines 183-186 $t->request_ok($tx) Link Here
183
  ->status_is(400)
192
  ->status_is(400)
184
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
193
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
185
194
195
$password_obj = {
196
    current_password    => $password,
197
    new_password        => "new password",
198
};
199
t::lib::Mocks::mock_preference("OpacPasswordChange", 0);
200
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
201
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
202
$t->request_ok($tx)
203
  ->status_is(403)
204
  ->json_is('/error', "OPAC password change is disabled");
205
206
t::lib::Mocks::mock_preference("OpacPasswordChange", 1);
207
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
208
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
209
$t->request_ok($tx)
210
  ->status_is(200);
211
186
$schema->storage->txn_rollback;
212
$schema->storage->txn_rollback;
187
- 

Return to bug 17006