View | Details | Raw Unified | Return to bug 17006
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons/Password.pm (-1 / +123 lines)
Line 0 Link Here
0
- 
1
package Koha::REST::V1::Patrons::Password;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it under the
6
# terms of the GNU General Public License as published by the Free Software
7
# Foundation; either version 3 of the License, or (at your option) any later
8
# version.
9
#
10
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
11
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
12
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
13
#
14
# You should have received a copy of the GNU General Public License along
15
# with Koha; if not, write to the Free Software Foundation, Inc.,
16
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17
18
use Modern::Perl;
19
20
use Mojo::Base 'Mojolicious::Controller';
21
22
use Koha::Exceptions::Password;
23
use Koha::Patrons;
24
25
use C4::Auth qw(checkpw_internal);
26
27
use Scalar::Util qw(blessed);
28
use Try::Tiny;
29
30
=head1 NAME
31
32
Koha::REST::V1::Patrons::Password
33
34
=head1 API
35
36
=head2 Methods
37
38
=head3 set
39
40
Controller method that sets a patron's password
41
42
=cut
43
44
sub set {
45
    my $c = shift->openapi->valid_input or return;
46
47
    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
48
    my $body   = $c->validation->param('body');
49
50
    unless ($patron) {
51
        return $c->render( status => 404, openapi => { error => "Patron not found." } );
52
    }
53
54
    return try {
55
56
        my $password     = $body->{ password };
57
        my $old_password = $body->{ old_password };
58
59
        ## Check if the patron is changing its own un-privileged account
60
        # Required permissions
61
        # TODO: Get rid of this once bug 21198 is implemented and integrated
62
        my $permissions
63
            = $c->match
64
                ->endpoint
65
                ->pattern
66
                ->defaults
67
                ->{'openapi.op_spec'}
68
                ->{'x-koha-authorization'}
69
                ->{'permissions'};
70
71
        my $user = $c->stash('koha.user');
72
73
        if ( !$user->has_permission( $permissions ) ) {
74
            # Doesn't have permissions, it reached here because it is
75
            # the user changing its own password, validate the provided password!
76
            if ( C4::Context->preference('OpacPasswordChange') ) {
77
                # self password change allowed, validate
78
                my $dbh = C4::Context->dbh;
79
                # test old_password is valid
80
                unless ( checkpw_internal($dbh, $patron->userid, $old_password ) ) {
81
                    Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password");
82
                }
83
            }
84
            else {
85
                # self password change not allowed
86
                Koha::Exceptions::Authorization::Unauthorized->throw("Configuration prevents password changes by unauthorized users");
87
            }
88
        }
89
90
        ## Change password
91
        # TODO: Use $patron->set_password when bug 21178 is pushed
92
        my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password );
93
        if ( !$is_valid ) {
94
            if ( $error eq 'too_short' ) {
95
                my $min_length = C4::Context->preference('minPasswordLength');
96
                $min_length = 3 if not $min_length or $min_length < 3;
97
98
                my $password_length = length($password) // 0;
99
                Koha::Exceptions::Password::TooShort->throw(
100
                    length => $password_length, min_length => $min_length );
101
            }
102
            elsif ( $error eq 'has_whitespaces' ) {
103
                Koha::Exceptions::Password::TrailingWhitespaces->throw(
104
                    "Password contains trailing spaces, which is forbidden.");
105
            }
106
            elsif ( $error eq 'too_weak' ) {
107
                Koha::Exceptions::Password::TooWeak->throw("Password is too weak");
108
            }
109
        }
110
111
        $patron->update_password( $patron->userid, $password );
112
        return $c->render( status => 200, openapi => "" );
113
    }
114
    catch {
115
        unless ( blessed $_ && $_->can('rethrow') ) {
116
            return $c->render( status => 500, openapi => { error => "$_" } );
117
        }
118
        # an exception was raised. return 400 with the stringified exception
119
        return $c->render( status => 400, openapi => { error => "$_" } );
120
    };
121
}
122
123
1;

Return to bug 17006