From 23cdc1894b5a8def16c521150a843e69ed788379 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Thu, 31 Jan 2019 16:29:30 -0300 Subject: [PATCH] Bug 21890: Allow restricting password resets by patron category This patch makes the templates relying on the OpacResetPassword syspref use the introduced TT plugin method instead by changing: [% IF Koha.Preference('OpacResetPassword') %] => [% IF Categories.can_any_reset_password %] To test: - Verify that all the places in which the 'forgot password' link is displayed in OPAC keep working, provided there's at least one category that has the flag set - Attempt to recover the password for a patron that belong to a valid category (i.e. that has the flag set) => SUCCESS: You can go through the normal process - Attempt to recover the password for a patron that belongs to a category with the flag unset. => SUCCESS: Once Koha identifies your category, you are told you are not allowed to do it - Sign off :-D Signed-off-by: Kyle M Hall --- .../intranet-tmpl/prog/en/modules/auth.tt | 3 +- .../bootstrap/en/includes/masthead.inc | 3 +- .../bootstrap/en/modules/opac-auth.tt | 3 +- .../bootstrap/en/modules/opac-main.tt | 3 +- .../en/modules/opac-password-recovery.tt | 5 +- opac/opac-password-recovery.pl | 57 +++++++++++-------- 6 files changed, 46 insertions(+), 28 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt index 19548caf57..7533b0cb8b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt @@ -1,6 +1,7 @@ [% USE raw %] [% USE Koha %] [% USE Branches %] +[% USE Categories %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] Koha › @@ -42,7 +43,7 @@ [% IF too_many_login_attempts %] <div id="login_error"><strong>Error: </strong>This account has been locked!</div> - [% IF Koha.Preference('OpacResetPassword') && Koha.Preference('OpacBaseURL') %] + [% IF Categories.can_any_reset_password && Koha.Preference('OpacBaseURL') %] <a href="[% Koha.Preference('OpacBaseURL') | url %]/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>. [% END %] [% ELSIF invalid_username_or_password %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc index 9466c2d9c6..3b5e9d9b8b 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -1,6 +1,7 @@ [% USE raw %] [% USE Koha %] [% USE Branches %] +[% USE Categories %] [% SET OpacLangSelectorMode = Koha.Preference('OpacLangSelectorMode') %] <div id="wrap"> <div id="header-region" class="noprint"> @@ -324,7 +325,7 @@ [% Koha.Preference( 'OpacLoginInstructions' ) | $raw %] </div> [% END %] - [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %] + [% IF Koha.Preference('OpacPasswordChange') && Categories.can_any_reset_password %] <div id="forgotpassword-modal" class="forgotpassword"> <a href="/cgi-bin/koha/opac-password-recovery.pl">Forgot your password?</a> </div> diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt index d8aeabec78..8bb82f56df 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -1,5 +1,6 @@ [% USE raw %] [% USE Koha %] +[% USE Categories %] [% INCLUDE 'doc-head-open.inc' %] <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog › [% IF Koha.Preference( 'opacuserlogin' ) == 1 %] @@ -169,7 +170,7 @@ <input type="submit" value="Log in" class="btn" /> <p/> - [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %] + [% IF Koha.Preference('OpacPasswordChange') && Categories.can_any_reset_password %] <div id="forgotpassword"> <a href="/cgi-bin/koha/opac-password-recovery.pl">Forgot your password?</a> </div> diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt index 35812fdc76..d65b001989 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt @@ -1,6 +1,7 @@ [% USE raw %] [% USE Koha %] [% USE Branches %] +[% USE Categories %] [% USE Price %] [% INCLUDE 'doc-head-open.inc' %] <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog @@ -129,7 +130,7 @@ [% Koha.Preference( 'OpacLoginInstructions' ) | $raw %] [% END %] - [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %] + [% IF Koha.Preference('OpacPasswordChange') && Categories.can_any_reset_password %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt index 73eb975eca..857b1c49dc 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt @@ -1,4 +1,5 @@ [% USE Koha %] +[% USE Categories %] [% INCLUDE 'doc-head-open.inc' %] [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %] - Forgotten password recovery[% ELSE %]Koha online[% END %] catalog - Forgotten password recovery [% INCLUDE 'doc-head-close.inc' %] @@ -77,13 +78,15 @@ [% ELSIF (errLinkNotValid) %] The link you clicked is either invalid, or expired.
Be sure you used the link from the email, or contact library staff for assistance. + [% ELSIF errNoBorrowerFound %] +
  • You are not allowed to reset your password. Contact library staff for assistance.
  • [% END %]

    Please contact the library if you need further assistance.

    [% END %]
    -[% IF (!Koha.Preference('OpacResetPassword')) %] +[% IF (! Categories.can_any_reset_password ) %]
    You can't reset your password.
    [% ELSIF (password_recovery) %]
    diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl index 6429f7b9a1..d66c2a9ca7 100755 --- a/opac/opac-password-recovery.pl +++ b/opac/opac-password-recovery.pl @@ -42,6 +42,7 @@ my $errMultipleAccountsForEmail; my $errAlreadyStartRecovery; my $errTooManyEmailFound; my $errBadEmail; +my $errResetForbidden; #new password form error my $errLinkNotValid; @@ -73,36 +74,45 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { $errMultipleAccountsForEmail = 1; } elsif ( $borrower = $search_results->next() ) { # One matching borrower - my @emails = grep { $_ } ( $borrower->email, $borrower->emailpro, $borrower->B_email ); - my $firstNonEmptyEmail; - $firstNonEmptyEmail = $emails[0] if @emails; + if ( $borrower->category->can_reset_password ) { - # Is the given email one of the borrower's ? - if ( $email && !( grep /^$email$/i, @emails ) ) { - $hasError = 1; - $errNoBorrowerFound = 1; - } + my @emails = grep { $_ } ( $borrower->email, $borrower->emailpro, $borrower->B_email ); - # If there is no given email, and there is no email on record - elsif ( !$email && !$firstNonEmptyEmail ) { - $hasError = 1; - $errNoBorrowerEmail = 1; - } + my $firstNonEmptyEmail; + $firstNonEmptyEmail = $emails[0] if @emails; + + # Is the given email one of the borrower's ? + if ( $email && !( grep /^$email$/i, @emails ) ) { + $hasError = 1; + $errNoBorrowerFound = 1; + } + + # If there is no given email, and there is no email on record + elsif ( !$email && !$firstNonEmptyEmail ) { + $hasError = 1; + $errNoBorrowerEmail = 1; + } -# Check if a password reset already issued for this borrower AND we are not asking for a new email - elsif ( not $query->param('resendEmail') ) { - if ( ValidateBorrowernumber( $borrower->borrowernumber ) ) { - $hasError = 1; - $errAlreadyStartRecovery = 1; + # Check if a password reset already issued for this + # borrower AND we are not asking for a new email + elsif ( not $query->param('resendEmail') ) { + if ( ValidateBorrowernumber( $borrower->borrowernumber ) ) { + $hasError = 1; + $errAlreadyStartRecovery = 1; + } + else { + DeleteExpiredPasswordRecovery( $borrower->borrowernumber ); + } } - else { - DeleteExpiredPasswordRecovery( $borrower->borrowernumber ); + # Set the $email, if we don't have one. + if ( !$hasError && !$email ) { + $email = $firstNonEmptyEmail; } } - # Set the $email, if we don't have one. - if ( !$hasError && !$email ) { - $email = $firstNonEmptyEmail; + else { + $hasError = 1; + $errResetForbidden = 1; } } else { # 0 matching borrower @@ -118,6 +128,7 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { errBadEmail => $errBadEmail, errNoBorrowerEmail => $errNoBorrowerEmail, errMultipleAccountsForEmail => $errMultipleAccountsForEmail, + errResetForbidden => $errResetForbidden, password_recovery => 1, email => HTML::Entities::encode($email), username => $username -- 2.17.2 (Apple Git-113)