From 42ebb125d4b24774fea2ca553825f83a90ad2a8d Mon Sep 17 00:00:00 2001
From: Alex Buckley <alexbuckley@catalyst.net.nz>
Date: Fri, 24 Nov 2017 11:42:25 +1300
Subject: [PATCH] Bug 18308 - Added warning and dialog alert

If an institution has a minPasswordLength which is < 8 characters then a warning
will be set (which is visible in the intranet-error.log) and a dialog
alert div will display the warning to the user in the memberentry.pl
page in the intranet.

Test plan:
1. Ensure that your minPasswordLength is set to less than 8 characters.
This replicates the use case that a Koha instance is existing (i.e. not
a new Koha instance) and not gone through the password length step of
the onboarding tool (previous patch on this bug report) or that the
institituion is new but set a password length of less than 8 in the
onboarding tool

2. Go to the memberentry.pl page and notice that there is no warning
at the top of the page informing you that your minPasswordLength is less
than 8

3. Apply this patch

4. Refresh the memberentry.pl page and notice that there is a yellow
warning at the top of the page informing you that your minPasswordLength
syspref is less than 8

Sponsored-By: Catalyst IT
---
 .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt    |  5 +++++
 .../prog/en/modules/onboarding/onboardingstep6.tt              |  3 ++-
 members/memberentry.pl                                         | 10 ++++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index 8a17653..5461e28 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -250,6 +250,11 @@ $(document).ready(function() {
 		</div>
 	[% END %]
 
+[% IF passwordwarning %]
+    <div class="dialog alert">
+        <p><strong> Warning: </strong> [% passwordwarning %]</p>
+    </div>
+[% END %]
 
 <div id="toolbar" class="btn-toolbar">
 [% UNLESS ( check_member ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt
index f024356..f88dbaa 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep6.tt
@@ -23,11 +23,12 @@
                     <h3>Congratulations you have finished and are ready to use Koha</h3>
                     <a class="btn btn-success" href="/cgi-bin/koha/mainpage.pl">Start using Koha</a>
                 [% ELSE %]
+
                     <h2>Web installer &rsaquo; Set minPasswordLength system preference </h2>
+
                     [% INCLUDE 'onboarding_messages.inc' %]
 
                     The minPasswordLength system preference is a setting for the shortest length library staff and patrons can set their passwords to.
-
                     <form name="setMinPasswordLength" method="post" action="onboarding.pl">
                         <fieldset class="rows">
                             <input type="hidden" name="step" value="6"/>
diff --git a/members/memberentry.pl b/members/memberentry.pl
index 13793e7..df27e07 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -174,6 +174,14 @@ $category_type="A" unless $category_type; # FIXME we should display a error mess
 # if a add or modify is requested => check validity of data.
 %data = %$borrower_data if ($borrower_data);
 
+#Check passwords
+my $minPasswordLength = C4::Context->preference('minPasswordLength');
+warn $minPasswordLength;
+if ($minPasswordLength < 8) {
+    warn my $warning = "Your minPasswordLength system preference is less than 8 characters this means library patrons can potentially set passwords which are vulnerable to cracking. Please set your minPasswordLength syspref to 8 or more characters";
+    $template->param("passwordwarning"=>$warning);
+}
+
 # initialize %newdata
 my %newdata;                                                                             # comes from $input->param()
 if ( $op eq 'insert' || $op eq 'modify' || $op eq 'save' || $op eq 'duplicate' ) {
@@ -355,6 +363,8 @@ if ($op eq 'save' || $op eq 'insert'){
     push @errors, "ERROR_login_exist";
   }
 
+
+
   my $password = $input->param('password');
   my $password2 = $input->param('password2');
   push @errors, "ERROR_password_mismatch" if ( $password ne $password2 );
-- 
2.1.4