View | Details | Raw Unified | Return to bug 17006
Collapse All | Expand All

(-)a/Koha/REST/V1/Patron.pm (-1 / +9 lines)
Lines 19-26 use Modern::Perl; Link Here
19
19
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
23
use C4::Auth qw( haspermission checkpw_internal );
22
use C4::Auth qw( haspermission checkpw_internal );
23
use C4::Context;
24
use Koha::Patrons;
24
use Koha::Patrons;
25
25
26
sub list {
26
sub list {
Lines 51-56 sub changepassword { Link Here
51
51
52
    my $user = $c->stash('koha.user');
52
    my $user = $c->stash('koha.user');
53
    my $patron = Koha::Patrons->find($args->{borrowernumber});
53
    my $patron = Koha::Patrons->find($args->{borrowernumber});
54
55
    my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange");
56
    unless ( $user
57
        && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber})
58
            || haspermission($user->userid, {borrowers => 1}) ) )
59
    {
60
        return $c->$cb({ error => "OPAC password change is disabled" }, 403);
61
    }
54
    return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
62
    return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
55
63
56
    my $pw = $args->{'body'};
64
    my $pw = $args->{'body'};
(-)a/t/db_dependent/api/v1/patrons.t (-2 / +26 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 39;
20
use Test::More tests => 44;
21
use Test::Mojo;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
22
use t::lib::TestBuilder;
23
use t::lib::Mocks;
23
use t::lib::Mocks;
Lines 58-63 my $borrower = $builder->build({ Link Here
58
        flags        => 0,
58
        flags        => 0,
59
        lost         => 1,
59
        lost         => 1,
60
        guarantorid  => $guarantor->{borrowernumber},
60
        guarantorid  => $guarantor->{borrowernumber},
61
        password     => Koha::AuthUtils::hash_password($password),
61
    }
62
    }
62
});
63
});
63
64
Lines 142-147 $session->param('ip', '127.0.0.1'); Link Here
142
$session->param('lasttime', time());
143
$session->param('lasttime', time());
143
$session->flush;
144
$session->flush;
144
145
146
my $session_nopermission = C4::Auth::get_session('');
147
$session_nopermission->param('number', $borrower->{ borrowernumber });
148
$session_nopermission->param('id', $borrower->{ userid });
149
$session_nopermission->param('ip', '127.0.0.1');
150
$session_nopermission->param('lasttime', time());
151
$session_nopermission->flush;
152
145
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
153
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
146
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
154
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
147
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
155
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
Lines 185-188 $t->request_ok($tx) Link Here
185
  ->status_is(400)
193
  ->status_is(400)
186
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
194
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
187
195
196
$password_obj = {
197
    current_password    => $password,
198
    new_password        => "new password",
199
};
200
t::lib::Mocks::mock_preference("OpacPasswordChange", 0);
201
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
202
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
203
$t->request_ok($tx)
204
  ->status_is(403)
205
  ->json_is('/error', "OPAC password change is disabled");
206
207
t::lib::Mocks::mock_preference("OpacPasswordChange", 1);
208
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
209
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
210
$t->request_ok($tx)
211
  ->status_is(200);
212
188
$schema->storage->txn_rollback;
213
$schema->storage->txn_rollback;
189
- 

Return to bug 17006