Bug 29925

Summary: Add a 'set new password' page for patron's with expired passwords
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: AuthenticationAssignee: Nick Clemens (kidclamp) <nick>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: andrewfh, bugzilla, dcook, dpavlin, fridolin.somers, m.de.rooy, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29926
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30605
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30611
Change sponsored?: Sponsored Patch complexity: Medium patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00
Bug Depends on: 29924    
Bug Blocks: 30761, 31489    
Attachments: Bug 29925: Add a password reset page for expired passwords
Bug 29925: Add a password reset page for expired passwords
Bug 29925: Add a password reset page for expired passwords
Bug 29925: (follow-up) Allow password reset when OpacPublic not set
Bug 29925: Add a password reset page for expired passwords
Bug 29925: (follow-up) Allow password reset when OpacPublic not set
Bug 29925: (follow-up) Fix copyright statement
Bug 29925: Add a password reset page for expired passwords
Bug 29925: (follow-up) Allow password reset when OpacPublic not set
Bug 29925: (follow-up) Add new pref in sysprefs.sql

Description Nick Clemens (kidclamp) 2022-01-21 17:18:59 UTC
Add a new page that will accept:
1 - Current password
2 - New password/confirmation
3 - Compare old and new password and confirm they are distinct, do not submit otherwise
4 - Save/update patron's password upon submission
5 - Update patron's password expiration
Comment 1 Nick Clemens (kidclamp) 2022-01-27 13:29:52 UTC Comment hidden (obsolete)
Comment 2 Nick Clemens (kidclamp) 2022-01-28 19:26:09 UTC
Created attachment 129958 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link
Comment 3 Nick Clemens (kidclamp) 2022-02-09 12:59:17 UTC
Created attachment 130357 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link
Comment 4 Andrew Fuerste-Henry 2022-02-09 21:29:45 UTC
There's a typo in the new syspref description. It says "If not enable patrons must either use the 'Forgot your password' feature or have staff reset their password." That should be "If not enabled."
Comment 5 Nick Clemens (kidclamp) 2022-02-10 12:20:41 UTC
Created attachment 130443 [details] [review]
Bug 29925: (follow-up) Allow password reset when OpacPublic not set
Comment 6 Andrew Fuerste-Henry 2022-02-16 17:20:03 UTC
Created attachment 130684 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 7 Andrew Fuerste-Henry 2022-02-16 17:20:06 UTC
Created attachment 130685 [details] [review]
Bug 29925: (follow-up) Allow password reset when OpacPublic not set

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 8 Marcel de Rooy 2022-04-23 15:07:04 UTC
diff --git a/opac/opac-reset-password.pl b/opac/opac-reset-password.pl
new file mode 100755
index 0000000000..c871cd534a
--- /dev/null
+++ b/opac/opac-reset-password.pl
@@ -0,0 +1,110 @@
+#!/usr/bin/perl
+# This script lets the users change the passwords by themselves.
+#
+# (c) 2005 Universidad ORT Uruguay.

Hmm New file from 2005 ?
Comment 9 Marcel de Rooy 2022-04-23 16:32:20 UTC
+                if ( $newpassword ne $confirmpassword ) {
+                    $template->param( 'error' => 'passwords_mismatch' );

If my password was 123Jim+1, and I just change to 123Jim+2, or change 3Jim@abc to 4Jim@abc, could we refuse such changes?
Look for some 'large enough' string that they have in common or so?
Or compare the number of positions where they are different?

Since this could well be considered scope creep, we could open a new report?
Comment 10 Marcel de Rooy 2022-04-23 16:34:50 UTC
(In reply to Marcel de Rooy from comment #9)
> +                if ( $newpassword ne $confirmpassword ) {
> +                    $template->param( 'error' => 'passwords_mismatch' );
> 
> If my password was 123Jim+1, and I just change to 123Jim+2, or change
> 3Jim@abc to 4Jim@abc, could we refuse such changes?
> Look for some 'large enough' string that they have in common or so?
> Or compare the number of positions where they are different?
> 
> Since this could well be considered scope creep, we could open a new report?

We needed these lines in code obviously:

+                elsif ( $currentpassword eq $newpassword ) {
+                    $template->param( 'error' => 'no_change' );
Comment 11 Nick Clemens (kidclamp) 2022-04-25 11:39:13 UTC
Created attachment 133749 [details] [review]
Bug 29925: (follow-up) Fix copyright statement
Comment 12 Nick Clemens (kidclamp) 2022-04-25 11:39:43 UTC
(In reply to Marcel de Rooy from comment #9)
> If my password was 123Jim+1, and I just change to 123Jim+2, or change
> 3Jim@abc to 4Jim@abc, could we refuse such changes?
> Look for some 'large enough' string that they have in common or so?
> Or compare the number of positions where they are different?
> 
> Since this could well be considered scope creep, we could open a new report?

Yes, please
Comment 13 Tomás Cohen Arazi 2022-05-02 19:54:21 UTC
Created attachment 134474 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 14 Tomás Cohen Arazi 2022-05-02 19:54:27 UTC
Created attachment 134475 [details] [review]
Bug 29925: (follow-up) Allow password reset when OpacPublic not set

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 15 Tomás Cohen Arazi 2022-05-02 19:55:08 UTC
I've fixed further license text issues and squashed those.
Comment 16 Fridolin Somers 2022-05-06 20:02:23 UTC
(In reply to Tomás Cohen Arazi from comment #14)
> Created attachment 134475 [details] [review] [review]
> Bug 29925: (follow-up) Allow password reset when OpacPublic not set
> 
> Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

OK so we can ignore the QA tools alert :
 FAIL	opac/opac-reset-password.pl
   FAIL	  forbidden patterns
		forbidden pattern: Script permissions is authnotrequired => 1, it is correct for an OPAC script, not intranet (bug 24663) (line 36)
Comment 17 Fridolin Somers 2022-05-06 20:02:55 UTC
Created attachment 134759 [details] [review]
Bug 29925: (follow-up) Add new pref in sysprefs.sql
Comment 18 Fridolin Somers 2022-05-06 20:34:14 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄