View | Details | Raw Unified | Return to bug 22061
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons/Password.pm (-1 / +62 lines)
Lines 19-24 use Modern::Perl; Link Here
19
19
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
use C4::Auth qw(checkpw_internal);
23
22
use Koha::Patrons;
24
use Koha::Patrons;
23
25
24
use Scalar::Util qw(blessed);
26
use Scalar::Util qw(blessed);
Lines 73-76 sub set { Link Here
73
    };
75
    };
74
}
76
}
75
77
78
=head3 set_public
79
80
Controller method that sets a patron's password, for unprivileged users
81
82
=cut
83
84
sub set_public {
85
86
    my $c = shift->openapi->valid_input or return;
87
88
    my $body      = $c->validation->param('body');
89
    my $patron_id = $c->validation->param('patron_id');
90
91
    unless ( C4::Context->preference('OpacPasswordChange') ) {
92
        return $c->render(
93
            status  => 403,
94
            openapi => { error => "Configuration prevents password changes by unprivileged users" }
95
        );
96
    }
97
98
    my $user = $c->stash('koha.user');
99
100
    unless ( $user->borrowernumber == $patron_id ) {
101
        return $c->render(
102
            status  => 403,
103
            openapi => {
104
                error => "Changing other patron's password is forbidden"
105
            }
106
        );
107
    }
108
109
    my $old_password = $body->{old_password};
110
    my $password     = $body->{password};
111
    my $password_2   = $body->{password_2};
112
113
    unless ( $password eq $password_2 ) {
114
        return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
115
    }
116
117
    return try {
118
        my $dbh = C4::Context->dbh;
119
        unless ( checkpw_internal($dbh, $user->userid, $old_password ) ) {
120
            Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password");
121
        }
122
123
        ## Change password
124
        $user->set_password($password);
125
126
        return $c->render( status => 200, openapi => "" );
127
    }
128
    catch {
129
        unless ( blessed $_ && $_->can('rethrow') ) {
130
            return $c->render( status => 500, openapi => { error => "$_" } );
131
        }
132
133
        # an exception was raised. return 400 with the stringified exception
134
        return $c->render( status => 400, openapi => { error => "$_" } );
135
    };
136
}
137
76
1;
138
1;
77
- 

Return to bug 22061