View | Details | Raw Unified | Return to bug 17006
Collapse All | Expand All

(-)a/Koha/REST/V1/Patron.pm (-1 / +9 lines)
Lines 19-26 use Modern::Perl; Link Here
19
19
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
23
use C4::Auth qw( haspermission checkpw_internal );
22
use C4::Auth qw( haspermission checkpw_internal );
23
use C4::Context;
24
use Koha::Patrons;
24
use Koha::Patrons;
25
25
26
sub list {
26
sub list {
Lines 51-56 sub changepassword { Link Here
51
51
52
    my $user = $c->stash('koha.user');
52
    my $user = $c->stash('koha.user');
53
    my $patron = Koha::Patrons->find($args->{borrowernumber});
53
    my $patron = Koha::Patrons->find($args->{borrowernumber});
54
55
    my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange");
56
    unless ( $user
57
        && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber})
58
            || haspermission($user->userid, {borrowers => 1}) ) )
59
    {
60
        return $c->$cb({ error => "OPAC password change is disabled" }, 403);
61
    }
54
    return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
62
    return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
55
63
56
    my $pw = $args->{'body'};
64
    my $pw = $args->{'body'};
(-)a/t/db_dependent/api/v1/patrons.t (-2 / +26 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 39;
20
use Test::More tests => 44;
21
use Test::Mojo;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
22
use t::lib::TestBuilder;
23
use t::lib::Mocks;
23
use t::lib::Mocks;
Lines 62-67 my $borrower = $builder->build({ Link Here
62
        flags        => 0,
62
        flags        => 0,
63
        lost         => 1,
63
        lost         => 1,
64
        guarantorid  => $guarantor->{borrowernumber},
64
        guarantorid  => $guarantor->{borrowernumber},
65
        password     => Koha::AuthUtils::hash_password($password),
65
    }
66
    }
66
});
67
});
67
68
Lines 146-151 $session->param('ip', '127.0.0.1'); Link Here
146
$session->param('lasttime', time());
147
$session->param('lasttime', time());
147
$session->flush;
148
$session->flush;
148
149
150
my $session_nopermission = C4::Auth::get_session('');
151
$session_nopermission->param('number', $borrower->{ borrowernumber });
152
$session_nopermission->param('id', $borrower->{ userid });
153
$session_nopermission->param('ip', '127.0.0.1');
154
$session_nopermission->param('lasttime', time());
155
$session_nopermission->flush;
156
149
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
157
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
150
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
158
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
151
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
159
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
Lines 189-192 $t->request_ok($tx) Link Here
189
  ->status_is(400)
197
  ->status_is(400)
190
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
198
  ->json_is('/error', "Password cannot contain trailing whitespaces.");
191
199
200
$password_obj = {
201
    current_password    => $password,
202
    new_password        => "new password",
203
};
204
t::lib::Mocks::mock_preference("OpacPasswordChange", 0);
205
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
206
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
207
$t->request_ok($tx)
208
  ->status_is(403)
209
  ->json_is('/error', "OPAC password change is disabled");
210
211
t::lib::Mocks::mock_preference("OpacPasswordChange", 1);
212
$tx = $t->ua->build_tx(PATCH => '/api/v1/patrons/'.$borrower->{borrowernumber}.'/password' => json => $password_obj);
213
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
214
$t->request_ok($tx)
215
  ->status_is(200);
216
192
$schema->storage->txn_rollback;
217
$schema->storage->txn_rollback;
193
- 

Return to bug 17006