View | Details | Raw Unified | Return to bug 22061
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/patrons_password.t (-2 / +89 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 1;
20
use Test::More tests => 2;
21
21
22
use Test::Mojo;
22
use Test::Mojo;
23
use Test::Warn;
23
use Test::Warn;
Lines 121-126 subtest 'set() (authorized user tests)' => sub { Link Here
121
    $schema->storage->txn_rollback;
121
    $schema->storage->txn_rollback;
122
};
122
};
123
123
124
subtest 'set_public() (unprivileged user tests)' => sub {
125
126
    plan tests => 15;
127
128
    $schema->storage->txn_begin;
129
130
    my ( $patron, $session ) = create_user_and_session({ authorized => 0 });
131
    my $other_patron = $builder->build_object({ class => 'Koha::Patrons' });
132
133
    # Enable the public API
134
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
135
136
    t::lib::Mocks::mock_preference( 'OpacPasswordChange',    0 );
137
    t::lib::Mocks::mock_preference( 'minPasswordLength',     3 );
138
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
139
140
    my $new_password = 'abc';
141
142
    my $tx
143
        = $t->ua->build_tx( POST => "/api/v1/public/patrons/"
144
            . $other_patron->id
145
            . "/password" => json => { password => $new_password, password_2 => $new_password, old_password => 'blah' } );
146
147
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
148
    $tx->req->env( { REMOTE_ADDR => '127.0.0.1' } );
149
    $t->request_ok($tx)
150
      ->status_is(403)
151
      ->json_is({
152
          error => 'Configuration prevents password changes by unprivileged users'
153
        });
154
155
    t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
156
157
    my $password = 'holapassword';
158
    $patron->set_password( $password );
159
    $tx
160
        = $t->ua->build_tx( POST => "/api/v1/public/patrons/"
161
            . $other_patron->id
162
            . "/password" => json => { password => $new_password, password_2 => $new_password, old_password => $password } );
163
164
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
165
    $tx->req->env( { REMOTE_ADDR => '127.0.0.1' } );
166
    $t->request_ok($tx)
167
      ->status_is(403)
168
      ->json_is({
169
          error => "Changing other patron's password is forbidden"
170
        });
171
172
    $tx
173
        = $t->ua->build_tx( POST => "/api/v1/public/patrons/"
174
            . $patron->id
175
            . "/password" => json => { password => $new_password, password_2 => 'wrong_password', old_password => $password } );
176
177
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
178
    $tx->req->env( { REMOTE_ADDR => '127.0.0.1' } );
179
    $t->request_ok($tx)
180
      ->status_is(400)
181
      ->json_is({
182
          error => "Passwords don't match"
183
        });
184
185
    $tx
186
        = $t->ua->build_tx( POST => "/api/v1/public/patrons/"
187
            . $patron->id
188
            . "/password" => json => { password => $new_password, password_2 => $new_password, old_password => 'badpassword' } );
189
190
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
191
    $tx->req->env( { REMOTE_ADDR => '127.0.0.1' } );
192
    $t->request_ok($tx)
193
      ->status_is(400)
194
      ->json_is({
195
          error => "Invalid password"
196
        });
197
198
    $tx
199
        = $t->ua->build_tx( POST => "/api/v1/public/patrons/"
200
            . $patron->id
201
            . "/password" => json => { password => $new_password, password_2 => $new_password, old_password => $password } );
202
203
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
204
    $tx->req->env( { REMOTE_ADDR => '127.0.0.1' } );
205
    $t->request_ok($tx)
206
      ->status_is(200)
207
      ->json_is('');
208
209
    $schema->storage->txn_rollback;
210
};
211
124
sub create_user_and_session {
212
sub create_user_and_session {
125
213
126
    my ( $args ) = @_;
214
    my ( $args ) = @_;
127
- 

Return to bug 22061