@@ -, +, @@ patron's passwords where YYY is existing borrowernumber (borrowers flag required) and where YYY is not the same borrowernumber as your logged-in user's borrowernumber --data '{"new_password":"1234"}' \ --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10' --- Koha/REST/V1/Patron.pm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/Koha/REST/V1/Patron.pm +++ a/Koha/REST/V1/Patron.pm @@ -53,21 +53,21 @@ sub changepassword { my $patron = Koha::Patrons->find($args->{borrowernumber}); my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange"); - unless ( $user - && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber}) - || haspermission($user->userid, {borrowers => 1}) ) ) - { + my $haspermission = haspermission($user->userid, {borrowers => 1}); + unless ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber} + || $haspermission) { return $c->$cb({ error => "OPAC password change is disabled" }, 403); } return $c->$cb({ error => "Patron not found." }, 404) unless $patron; my $pw = $args->{'body'}; my $dbh = C4::Context->dbh; - unless (checkpw_internal($dbh, $user->userid, $pw->{'current_password'})) { + unless ($haspermission + || checkpw_internal($dbh, $patron->userid, $pw->{'current_password'})) { return $c->$cb({ error => "Wrong current password." }, 400); } - my ($success, $errmsg) = $user->change_password_to($pw->{'new_password'}); + my ($success, $errmsg) = $patron->change_password_to($pw->{'new_password'}); if ($errmsg) { return $c->$cb({ error => $errmsg }, 400); } --