From b93d9f8e5379758c48bdb4bf7d620fe202df70b3 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Thu, 16 Aug 2018 07:02:17 -0300 Subject: [PATCH] Bug 17006: Add /patrons/{patron_id}/password This patch introduces an endpoint for changing a patron's password. To test: - Apply this patchset - Run: $ kshell k$ prove t/db_dependent/api/v1/patrons_password.t => SUCCESS: tests pass! - Play with the different use cases highlighted by the tests, on your favourite REST testing tool (Postman, RESTer on FF, etc). Signed-off-by: Tomas Cohen Arazi --- Koha/REST/V1/Patrons/Password.pm | 123 +++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 Koha/REST/V1/Patrons/Password.pm diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm new file mode 100644 index 0000000000..35f51dd26b --- /dev/null +++ b/Koha/REST/V1/Patrons/Password.pm @@ -0,0 +1,123 @@ +package Koha::REST::V1::Patrons::Password; + +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it under the +# terms of the GNU General Public License as published by the Free Software +# Foundation; either version 3 of the License, or (at your option) any later +# version. +# +# Koha is distributed in the hope that it will be useful, but WITHOUT ANY +# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR +# A PARTICULAR PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with Koha; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +use Modern::Perl; + +use Mojo::Base 'Mojolicious::Controller'; + +use Koha::Exceptions::Password; +use Koha::Patrons; + +use C4::Auth qw(checkpw_internal); + +use Scalar::Util qw(blessed); +use Try::Tiny; + +=head1 NAME + +Koha::REST::V1::Patrons::Password + +=head1 API + +=head2 Methods + +=head3 set + +Controller method that sets a patron's password + +=cut + +sub set { + my $c = shift->openapi->valid_input or return; + + my $patron = Koha::Patrons->find( $c->validation->param('patron_id') ); + my $body = $c->validation->param('body'); + + unless ($patron) { + return $c->render( status => 404, openapi => { error => "Patron not found." } ); + } + + return try { + + my $password = $body->{ password }; + my $old_password = $body->{ old_password }; + + ## Check if the patron is changing its own un-privileged account + # Required permissions + # TODO: Get rid of this once bug 21198 is implemented and integrated + my $permissions + = $c->match + ->endpoint + ->pattern + ->defaults + ->{'openapi.op_spec'} + ->{'x-koha-authorization'} + ->{'permissions'}; + + my $user = $c->stash('koha.user'); + + if ( !$user->has_permission( $permissions ) ) { + # Doesn't have permissions, it reached here because it is + # the user changing its own password, validate the provided password! + if ( C4::Context->preference('OpacPasswordChange') ) { + # self password change allowed, validate + my $dbh = C4::Context->dbh; + # test old_password is valid + unless ( checkpw_internal($dbh, $patron->userid, $old_password ) ) { + Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password"); + } + } + else { + # self password change not allowed + Koha::Exceptions::Authorization::Unauthorized->throw("Configuration prevents password changes by unauthorized users"); + } + } + + ## Change password + # TODO: Use $patron->set_password when bug 21178 is pushed + my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password ); + if ( !$is_valid ) { + if ( $error eq 'too_short' ) { + my $min_length = C4::Context->preference('minPasswordLength'); + $min_length = 3 if not $min_length or $min_length < 3; + + my $password_length = length($password) // 0; + Koha::Exceptions::Password::TooShort->throw( + length => $password_length, min_length => $min_length ); + } + elsif ( $error eq 'has_whitespaces' ) { + Koha::Exceptions::Password::TrailingWhitespaces->throw( + "Password contains trailing spaces, which is forbidden."); + } + elsif ( $error eq 'too_weak' ) { + Koha::Exceptions::Password::TooWeak->throw("Password is too weak"); + } + } + + $patron->update_password( $patron->userid, $password ); + return $c->render( status => 200, openapi => "" ); + } + catch { + unless ( blessed $_ && $_->can('rethrow') ) { + return $c->render( status => 500, openapi => { error => "$_" } ); + } + # an exception was raised. return 400 with the stringified exception + return $c->render( status => 400, openapi => { error => "$_" } ); + }; +} + +1; -- 2.18.0