View | Details | Raw Unified | Return to bug 21087
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-2 / +2 lines)
Lines 344-353 sub _do_changepassword { Link Here
344
        $sth->execute($borrowerid);
344
        $sth->execute($borrowerid);
345
        return $cardnum;
345
        return $cardnum;
346
    }
346
    }
347
    my $digest = hash_password($password);
348
347
348
    my $digest = hash_password($password);
349
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
349
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
350
    Koha::Patrons->find($borrowerid)->update_password( $userid, $digest );
350
    Koha::Patrons->find($borrowerid)->update_password( $userid, $password );
351
351
352
    my ($ok, $cardnum) = checkpw_internal(C4::Context->dbh, $userid, $password);
352
    my ($ok, $cardnum) = checkpw_internal(C4::Context->dbh, $userid, $password);
353
    return $cardnum if $ok;
353
    return $cardnum if $ok;
(-)a/Koha/Patron.pm (-15 / +15 lines)
Lines 28-33 use Text::Unaccent qw( unac_string ); Link Here
28
28
29
use C4::Context;
29
use C4::Context;
30
use C4::Log;
30
use C4::Log;
31
use Koha::AuthUtils;
31
use Koha::Checkouts;
32
use Koha::Checkouts;
32
use Koha::Database;
33
use Koha::Database;
33
use Koha::DateUtils;
34
use Koha::DateUtils;
Lines 267-286 sub store { Link Here
267
                  if C4::Context->preference("BorrowersLog");
268
                  if C4::Context->preference("BorrowersLog");
268
            }
269
            }
269
            else {    #ModMember
270
            else {    #ModMember
270
                # test to know if you must update or not the borrower password
271
                # We could add a test here to make sure the password is not update (?)
271
                if ( defined $self->password ) {
272
                    if ( $self->password eq '****' or $self->password eq '' ) {
273
                        $self->password(undef);
274
                    } else {
275
                        if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preference('NorwegianPatronDBEnable') == 1 ) {
276
                            # Update the hashed PIN in borrower_sync.hashed_pin, before Koha hashes it
277
                            Koha::NorwegianPatronDB::NLUpdateHashedPIN( $self->borrowernumber, $self->password );
278
                        }
279
                        $self->password(Koha::AuthUtils::hash_password($self->password));
280
                    }
281
                }
282
272
283
                 # Come from ModMember, but should not be possible (?)
273
                # Come from ModMember, but should not be possible (?)
284
                $self->dateenrolled(undef) unless $self->dateenrolled;
274
                $self->dateenrolled(undef) unless $self->dateenrolled;
285
                $self->dateexpiry(undef)   unless $self->dateexpiry;
275
                $self->dateexpiry(undef)   unless $self->dateexpiry;
286
276
Lines 687-700 sub update_password { Link Here
687
    my ( $self, $userid, $password ) = @_;
677
    my ( $self, $userid, $password ) = @_;
688
    eval { $self->userid($userid)->store; };
678
    eval { $self->userid($userid)->store; };
689
    return if $@; # Make sure the userid is not already in used by another patron
679
    return if $@; # Make sure the userid is not already in used by another patron
680
681
    return 0 if $password eq '****' or $password eq ''; # Do we need that?
682
683
    if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preference('NorwegianPatronDBEnable') == 1 ) {
684
        # Update the hashed PIN in borrower_sync.hashed_pin, before Koha hashes it
685
        Koha::NorwegianPatronDB::NLUpdateHashedPIN( $self->borrowernumber, $password );
686
    }
687
688
    my $digest = Koha::AuthUtils::hash_password($password);
690
    $self->update(
689
    $self->update(
691
        {
690
        {
692
            password       => $password,
691
            password       => $digest,
693
            login_attempts => 0,
692
            login_attempts => 0,
694
        }
693
        }
695
    );
694
    );
695
696
    logaction( "MEMBERS", "CHANGE PASS", $self->borrowernumber, "" ) if C4::Context->preference("BorrowersLog");
696
    logaction( "MEMBERS", "CHANGE PASS", $self->borrowernumber, "" ) if C4::Context->preference("BorrowersLog");
697
    return 1;
697
    return $digest;
698
}
698
}
699
699
700
=head3 renew_account
700
=head3 renew_account
(-)a/members/member-password.pl (-2 / +2 lines)
Lines 78-87 if ( $newpassword and not @errors) { Link Here
78
            token  => scalar $input->param('csrf_token'),
78
            token  => scalar $input->param('csrf_token'),
79
        });
79
        });
80
80
81
    my $digest = Koha::AuthUtils::hash_password( scalar $input->param('newpassword') );
82
    my $uid    = $input->param('newuserid') || $bor->{userid};
81
    my $uid    = $input->param('newuserid') || $bor->{userid};
82
    my $password = $input->param('newpassword');
83
    my $dbh    = C4::Context->dbh;
83
    my $dbh    = C4::Context->dbh;
84
    if ( Koha::Patrons->find( $member )->update_password($uid, $digest) ) {
84
    if ( Koha::Patrons->find( $member )->update_password($uid, $password) ) {
85
        $template->param( newpassword => $newpassword );
85
        $template->param( newpassword => $newpassword );
86
        if ( $destination eq 'circ' ) {
86
        if ( $destination eq 'circ' ) {
87
            print $input->redirect("/cgi-bin/koha/circ/circulation.pl?findborrower=$cardnumber");
87
            print $input->redirect("/cgi-bin/koha/circ/circulation.pl?findborrower=$cardnumber");
(-)a/members/memberentry.pl (+1 lines)
Lines 537-542 if ((!$nok) and $nodouble and ($op eq 'insert' or $op eq 'save')){ Link Here
537
                                                                # updating any columns in the borrowers table,
537
                                                                # updating any columns in the borrowers table,
538
                                                                # which can happen if we're only editing the
538
                                                                # which can happen if we're only editing the
539
                                                                # patron attributes or messaging preferences sections
539
                                                                # patron attributes or messaging preferences sections
540
        $patron->update_password($newdata{password}); # If != **** or '' # test here?
540
        if (C4::Context->preference('ExtendedPatronAttributes') and $input->param('setting_extended_patron_attributes')) {
541
        if (C4::Context->preference('ExtendedPatronAttributes') and $input->param('setting_extended_patron_attributes')) {
541
            C4::Members::Attributes::SetBorrowerAttributes($borrowernumber, $extended_patron_attributes);
542
            C4::Members::Attributes::SetBorrowerAttributes($borrowernumber, $extended_patron_attributes);
542
        }
543
        }
(-)a/opac/opac-password-recovery.pl (-2 / +1 lines)
Lines 10-16 use C4::Context; Link Here
10
use Koha::Patron::Password::Recovery
10
use Koha::Patron::Password::Recovery
11
  qw(SendPasswordRecoveryEmail ValidateBorrowernumber GetValidLinkInfo CompletePasswordRecovery DeleteExpiredPasswordRecovery);
11
  qw(SendPasswordRecoveryEmail ValidateBorrowernumber GetValidLinkInfo CompletePasswordRecovery DeleteExpiredPasswordRecovery);
12
use Koha::Patrons;
12
use Koha::Patrons;
13
use Koha::AuthUtils qw(hash_password);
14
use Koha::Patrons;
13
use Koha::Patrons;
15
my $query = new CGI;
14
my $query = new CGI;
16
use HTML::Entities;
15
use HTML::Entities;
Lines 156-162 elsif ( $query->param('passwordReset') ) { Link Here
156
            $error = 'password_too_weak' if $err eq 'too_weak';
155
            $error = 'password_too_weak' if $err eq 'too_weak';
157
            $error = 'password_has_whitespaces' if $err eq 'has_whitespaces';
156
            $error = 'password_has_whitespaces' if $err eq 'has_whitespaces';
158
        } else {
157
        } else {
159
            Koha::Patrons->find($borrower_number)->update_password( $username, hash_password($password) );
158
            Koha::Patrons->find($borrower_number)->update_password( $username, $password );
160
            CompletePasswordRecovery($uniqueKey);
159
            CompletePasswordRecovery($uniqueKey);
161
            $template->param(
160
            $template->param(
162
                password_reset_done => 1,
161
                password_reset_done => 1,
(-)a/t/db_dependent/Auth.t (-1 / +1 lines)
Lines 120-126 my $hash2 = hash_password('password'); Link Here
120
120
121
{ # tests no_set_userenv parameter
121
{ # tests no_set_userenv parameter
122
    my $patron = $builder->build( { source => 'Borrower' } );
122
    my $patron = $builder->build( { source => 'Borrower' } );
123
    Koha::Patrons->find( $patron->{borrowernumber} )->update_password( $patron->{userid}, $hash1 );
123
    Koha::Patrons->find( $patron->{borrowernumber} )->update_password( $patron->{userid}, 'password' );
124
    my $library = $builder->build(
124
    my $library = $builder->build(
125
        {
125
        {
126
            source => 'Branch',
126
            source => 'Branch',
(-)a/t/db_dependent/Koha/Patrons.t (-3 / +3 lines)
Lines 173-181 subtest 'update_password' => sub { Link Here
173
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->userid,   $original_userid,   'Koha::Patron->update_password should not have updated the userid' );
173
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->userid,   $original_userid,   'Koha::Patron->update_password should not have updated the userid' );
174
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->password, $original_password, 'Koha::Patron->update_password should not have updated the userid' );
174
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->password, $original_password, 'Koha::Patron->update_password should not have updated the userid' );
175
175
176
    $retrieved_patron_1->update_password( 'another_nonexistent_userid_1', 'another_password' );
176
    my $digest = $retrieved_patron_1->update_password( 'another_nonexistent_userid_1', 'another_password' );
177
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->userid,   'another_nonexistent_userid_1', 'Koha::Patron->update_password should have updated the userid' );
177
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->userid,   'another_nonexistent_userid_1', 'Koha::Patron->update_password should have updated the userid' );
178
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->password, 'another_password',             'Koha::Patron->update_password should have updated the password' );
178
    is( Koha::Patrons->find( $new_patron_1->borrowernumber )->password, $digest,             'Koha::Patron->update_password should have updated the password' );
179
179
180
    my $number_of_logs = $schema->resultset('ActionLog')->search( { module => 'MEMBERS', action => 'CHANGE PASS', object => $new_patron_1->borrowernumber } )->count;
180
    my $number_of_logs = $schema->resultset('ActionLog')->search( { module => 'MEMBERS', action => 'CHANGE PASS', object => $new_patron_1->borrowernumber } )->count;
181
    is( $number_of_logs, 1, 'With BorrowerLogs, Koha::Patron->update_password should have logged' );
181
    is( $number_of_logs, 1, 'With BorrowerLogs, Koha::Patron->update_password should have logged' );
Lines 1444-1450 subtest '->store' => sub { Link Here
1444
1444
1445
    # Test password
1445
    # Test password
1446
    my $password = 'password';
1446
    my $password = 'password';
1447
    $patron_1->password($password)->store;
1447
    $patron_1->update_password($patron_1->userid, $password);
1448
    like( $patron_1->password, qr|^\$2|, 'Password should be hashed using bcrypt (start with $2)' );
1448
    like( $patron_1->password, qr|^\$2|, 'Password should be hashed using bcrypt (start with $2)' );
1449
    my $digest = $patron_1->password;
1449
    my $digest = $patron_1->password;
1450
    $patron_1->surname('xxx')->store;
1450
    $patron_1->surname('xxx')->store;
(-)a/t/db_dependent/Search/History.t (-3 / +1 lines)
Lines 9-15 use t::lib::Mocks; Link Here
9
use t::lib::TestBuilder;
9
use t::lib::TestBuilder;
10
10
11
use C4::Auth;
11
use C4::Auth;
12
use Koha::AuthUtils qw/hash_password/;
13
use Koha::Database;
12
use Koha::Database;
14
13
15
use Test::More tests => 27;
14
use Test::More tests => 27;
Lines 369-377 my $schema = Koha::Database->schema; Link Here
369
my $builder = t::lib::TestBuilder->new;
368
my $builder = t::lib::TestBuilder->new;
370
369
371
# Borrower Creation
370
# Borrower Creation
372
my $hash = hash_password('password');
373
our $patron = $builder->build( { source => 'Borrower' } );
371
our $patron = $builder->build( { source => 'Borrower' } );
374
Koha::Patrons->find( $patron->{borrowernumber} )->update_password( $patron->{userid}, $hash );
372
Koha::Patrons->find( $patron->{borrowernumber} )->update_password( $patron->{userid}, 'password' );
375
373
376
my $session = C4::Auth::get_session("");
374
my $session = C4::Auth::get_session("");
377
$session->flush;
375
$session->flush;
(-)a/t/db_dependent/selenium/authentication.t (-4 / +2 lines)
Lines 47-55 SKIP: { Link Here
47
        like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form');
47
        like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form');
48
48
49
        my $password = Koha::AuthUtils::generate_password();
49
        my $password = Koha::AuthUtils::generate_password();
50
        my $digest = Koha::AuthUtils::hash_password( $password );
51
        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 0 }});
50
        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 0 }});
52
        $patron->update_password( $patron->userid, $digest );
51
        $patron->update_password( $patron->userid, $password );
53
52
54
        # Patron does not have permission to access staff interface
53
        # Patron does not have permission to access staff interface
55
        $s->auth( $patron->userid, $password );
54
        $s->auth( $patron->userid, $password );
Lines 79-87 SKIP: { Link Here
79
        like( $driver->get_title, qr(Koha online catalog), 'Hitting the main page should not redirect to the login form');
78
        like( $driver->get_title, qr(Koha online catalog), 'Hitting the main page should not redirect to the login form');
80
79
81
        my $password = Koha::AuthUtils::generate_password();
80
        my $password = Koha::AuthUtils::generate_password();
82
        my $digest = Koha::AuthUtils::hash_password( $password );
83
        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 0 }});
81
        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 0 }});
84
        $patron->update_password( $patron->userid, $digest );
82
        $patron->update_password( $patron->userid, $password );
85
83
86
        # Using the modal
84
        # Using the modal
87
        $driver->find_element('//a[@class="login-link loginModal-trigger"]')->click;
85
        $driver->find_element('//a[@class="login-link loginModal-trigger"]')->click;
(-)a/t/db_dependent/selenium/regressions.t (-3 / +1 lines)
Lines 41-48 subtest 'OPAC - borrowernumber and branchcode as html attributes' => sub { Link Here
41
    my $patron = $builder->build_object(
41
    my $patron = $builder->build_object(
42
        { class => 'Koha::Patrons', value => { flags => 1 } } );
42
        { class => 'Koha::Patrons', value => { flags => 1 } } );
43
    my $password = Koha::AuthUtils::generate_password();
43
    my $password = Koha::AuthUtils::generate_password();
44
    my $digest   = Koha::AuthUtils::hash_password($password);
44
    $patron->update_password( $patron->userid, $password );
45
    $patron->update_password( $patron->userid, $digest );
46
    $s->opac_auth( $patron->userid, $password );
45
    $s->opac_auth( $patron->userid, $password );
47
    my $elt = $driver->find_element('//span[@class="loggedinusername"]');
46
    my $elt = $driver->find_element('//span[@class="loggedinusername"]');
48
    is( $elt->get_attribute('data-branchcode'), $patron->library->branchcode,
47
    is( $elt->get_attribute('data-branchcode'), $patron->library->branchcode,
49
- 

Return to bug 21087