Bugzilla – Attachment 56400 Details for
Bug 17006
Add route to change patron's password (authenticated)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17006: (follow-up) Let librarians change patron's passwords
Bug-17006-follow-up-Let-librarians-change-patrons-.patch (text/plain), 2.55 KB, created by
Lari Taskula
on 2016-10-13 13:28:37 UTC
(
hide
)
Description:
Bug 17006: (follow-up) Let librarians change patron's passwords
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2016-10-13 13:28:37 UTC
Size:
2.55 KB
patch
obsolete
>From 0f41a73a079ecb95be0705dc5a47e3b23f02606d Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@jns.fi> >Date: Thu, 13 Oct 2016 15:21:57 +0300 >Subject: [PATCH] Bug 17006: (follow-up) Let librarians change patron's > passwords > >This should obviously be part of this feature but was left unnoticed in the >first patch. If user has "borrowers"-flag, they should be able to change patron's >password without providing old password. > >To test: >1. Run t/db_dependent/api/v1/patrons.t >2. Observe failing test >3. Apply patch >4. Run t/db_dependent/api/v1/patrons.t >5. Observe passing test >6. Send PATCH request to http://library/api/v1/patrons/YYY/password > where YYY is existing borrowernumber (borrowers flag required) > and where YYY is not the same borrowernumber as your logged-in > user's borrowernumber >7. Make sure that password was changed for YYY. > >You may find this useful for testing: > >curl -X PATCH http://library/api/v1/patrons/123/password \ > --data '{"new_password":"1234"}' \ > --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10' >--- > Koha/REST/V1/Patron.pm | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > >diff --git a/Koha/REST/V1/Patron.pm b/Koha/REST/V1/Patron.pm >index 2660e7f..2f5c0a9 100644 >--- a/Koha/REST/V1/Patron.pm >+++ b/Koha/REST/V1/Patron.pm >@@ -53,21 +53,21 @@ sub changepassword { > my $patron = Koha::Patrons->find($args->{borrowernumber}); > > my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange"); >- unless ( $user >- && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber}) >- || haspermission($user->userid, {borrowers => 1}) ) ) >- { >+ my $haspermission = haspermission($user->userid, {borrowers => 1}); >+ unless ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber} >+ || $haspermission) { > return $c->$cb({ error => "OPAC password change is disabled" }, 403); > } > return $c->$cb({ error => "Patron not found." }, 404) unless $patron; > > my $pw = $args->{'body'}; > my $dbh = C4::Context->dbh; >- unless (checkpw_internal($dbh, $user->userid, $pw->{'current_password'})) { >+ unless ($haspermission >+ || checkpw_internal($dbh, $patron->userid, $pw->{'current_password'})) { > return $c->$cb({ error => "Wrong current password." }, 400); > } > >- my ($success, $errmsg) = $user->change_password_to($pw->{'new_password'}); >+ my ($success, $errmsg) = $patron->change_password_to($pw->{'new_password'}); > if ($errmsg) { > return $c->$cb({ error => $errmsg }, 400); > } >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17006
:
54575
|
54576
|
54629
|
54630
|
54716
|
54717
|
54718
|
56155
|
56156
|
56157
|
56158
|
56283
|
56284
|
56399
|
56400
|
56401
|
56409
|
57356
|
57357
|
57358
|
57359
|
57360
|
63329
|
63330
|
63331
|
63332
|
63333
|
67128
|
67129
|
67130
|
67131
|
67132
|
70260
|
70261
|
70262
|
70263
|
70264
|
77882
|
77883
|
77884
|
77923
|
77924
|
77925
|
78837
|
82625
|
82626
|
82627
|
82628
|
83579
|
83580
|
83581
|
83749
|
83750
|
83751
|
84285
|
84286
|
84287
|
84488