Bug 29925 - Add a 'set new password' page for patron's with expired passwords
Summary: Add a 'set new password' page for patron's with expired passwords
Status: Pushed to master
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Nick Clemens
QA Contact: Testopia
URL:
Keywords:
Depends on: 29924
Blocks: 31489 30761
  Show dependency treegraph
 
Reported: 2022-01-21 17:18 UTC by Nick Clemens
Modified: 2022-08-30 16:12 UTC (History)
7 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: Medium patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00


Attachments
Bug 29925: Add a password reset page for expired passwords (19.62 KB, patch)
2022-01-27 13:29 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29925: Add a password reset page for expired passwords (19.56 KB, patch)
2022-01-28 19:26 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29925: Add a password reset page for expired passwords (20.54 KB, patch)
2022-02-09 12:59 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29925: (follow-up) Allow password reset when OpacPublic not set (740 bytes, patch)
2022-02-10 12:20 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29925: Add a password reset page for expired passwords (20.59 KB, patch)
2022-02-16 17:20 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29925: (follow-up) Allow password reset when OpacPublic not set (792 bytes, patch)
2022-02-16 17:20 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29925: (follow-up) Fix copyright statement (773 bytes, patch)
2022-04-25 11:39 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29925: Add a password reset page for expired passwords (20.48 KB, patch)
2022-05-02 19:54 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29925: (follow-up) Allow password reset when OpacPublic not set (847 bytes, patch)
2022-05-02 19:54 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29925: (follow-up) Add new pref in sysprefs.sql (1.52 KB, patch)
2022-05-06 20:02 UTC, Fridolin Somers
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2022-01-21 17:18:59 UTC
Add a new page that will accept:
1 - Current password
2 - New password/confirmation
3 - Compare old and new password and confirm they are distinct, do not submit otherwise
4 - Save/update patron's password upon submission
5 - Update patron's password expiration
Comment 1 Nick Clemens 2022-01-27 13:29:52 UTC Comment hidden (obsolete)
Comment 2 Nick Clemens 2022-01-28 19:26:09 UTC
Created attachment 129958 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link
Comment 3 Nick Clemens 2022-02-09 12:59:17 UTC
Created attachment 130357 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link
Comment 4 Andrew Fuerste-Henry 2022-02-09 21:29:45 UTC
There's a typo in the new syspref description. It says "If not enable patrons must either use the 'Forgot your password' feature or have staff reset their password." That should be "If not enabled."
Comment 5 Nick Clemens 2022-02-10 12:20:41 UTC
Created attachment 130443 [details] [review]
Bug 29925: (follow-up) Allow password reset when OpacPublic not set
Comment 6 Andrew Fuerste-Henry 2022-02-16 17:20:03 UTC
Created attachment 130684 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 7 Andrew Fuerste-Henry 2022-02-16 17:20:06 UTC
Created attachment 130685 [details] [review]
Bug 29925: (follow-up) Allow password reset when OpacPublic not set

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 8 Marcel de Rooy 2022-04-23 15:07:04 UTC
diff --git a/opac/opac-reset-password.pl b/opac/opac-reset-password.pl
new file mode 100755
index 0000000000..c871cd534a
--- /dev/null
+++ b/opac/opac-reset-password.pl
@@ -0,0 +1,110 @@
+#!/usr/bin/perl
+# This script lets the users change the passwords by themselves.
+#
+# (c) 2005 Universidad ORT Uruguay.

Hmm New file from 2005 ?
Comment 9 Marcel de Rooy 2022-04-23 16:32:20 UTC
+                if ( $newpassword ne $confirmpassword ) {
+                    $template->param( 'error' => 'passwords_mismatch' );

If my password was 123Jim+1, and I just change to 123Jim+2, or change 3Jim@abc to 4Jim@abc, could we refuse such changes?
Look for some 'large enough' string that they have in common or so?
Or compare the number of positions where they are different?

Since this could well be considered scope creep, we could open a new report?
Comment 10 Marcel de Rooy 2022-04-23 16:34:50 UTC
(In reply to Marcel de Rooy from comment #9)
> +                if ( $newpassword ne $confirmpassword ) {
> +                    $template->param( 'error' => 'passwords_mismatch' );
> 
> If my password was 123Jim+1, and I just change to 123Jim+2, or change
> 3Jim@abc to 4Jim@abc, could we refuse such changes?
> Look for some 'large enough' string that they have in common or so?
> Or compare the number of positions where they are different?
> 
> Since this could well be considered scope creep, we could open a new report?

We needed these lines in code obviously:

+                elsif ( $currentpassword eq $newpassword ) {
+                    $template->param( 'error' => 'no_change' );
Comment 11 Nick Clemens 2022-04-25 11:39:13 UTC
Created attachment 133749 [details] [review]
Bug 29925: (follow-up) Fix copyright statement
Comment 12 Nick Clemens 2022-04-25 11:39:43 UTC
(In reply to Marcel de Rooy from comment #9)
> If my password was 123Jim+1, and I just change to 123Jim+2, or change
> 3Jim@abc to 4Jim@abc, could we refuse such changes?
> Look for some 'large enough' string that they have in common or so?
> Or compare the number of positions where they are different?
> 
> Since this could well be considered scope creep, we could open a new report?

Yes, please
Comment 13 Tomás Cohen Arazi 2022-05-02 19:54:21 UTC
Created attachment 134474 [details] [review]
Bug 29925: Add a password reset page for expired passwords

This patch adds a new page opac-reset-password where a user cna enter their login
(userid or carndumber), current password, and new password.

If the user has a password expiration date and the current password is correct and
the new passwords match and meet requirements their password will be updated and the
expiration date reset

A patron whose password does not expire will be reidrected to login to change their password

To test:
 1 - Apply patch, updatedatabase, enable new syspref EnableExpiredPasswordReset
 2 - Set 'Password expiration' for a patron category
     Home->Administration->Patron categories->Edit
 3 - Create a new patron in this category with a userid/password set, and an email
 4 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration='2022-01-01' WHERE borrowernumber=51;
 5 - Give the borrower catalogue permission
 6 - Attempt to log in to Straff interface
 7 - Confirm you are signed out and notified that password must be reset
 8 - Click 'Reset your password' link
 9 - You should see the reset password page with fields for: login, current password, new password, conmfirm password
10 - enter invalid/incomplete credentials
11 - Confirm you are notified of invlaid credentials
12 - Fill in all fields, but enter current password as new password
13 - Confirm you are notified of no change
14 - Set minimum password length / strong password requirement for category
15 - Confirm you receive error if new password too short or not secure
16 - Enter a valid new password and submit and confirm update is successful
17 - Confirm you have buttons to go to OPAC or Staff and that both work
18 - Confirm you cna log in (i.e. expiration has been reset)
19 - Expire the users password
20 - Remove catalogue permission
21 - Reset password again and confirm only OPAC link

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 14 Tomás Cohen Arazi 2022-05-02 19:54:27 UTC
Created attachment 134475 [details] [review]
Bug 29925: (follow-up) Allow password reset when OpacPublic not set

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 15 Tomás Cohen Arazi 2022-05-02 19:55:08 UTC
I've fixed further license text issues and squashed those.
Comment 16 Fridolin Somers 2022-05-06 20:02:23 UTC
(In reply to Tomás Cohen Arazi from comment #14)
> Created attachment 134475 [details] [review] [review]
> Bug 29925: (follow-up) Allow password reset when OpacPublic not set
> 
> Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

OK so we can ignore the QA tools alert :
 FAIL	opac/opac-reset-password.pl
   FAIL	  forbidden patterns
		forbidden pattern: Script permissions is authnotrequired => 1, it is correct for an OPAC script, not intranet (bug 24663) (line 36)
Comment 17 Fridolin Somers 2022-05-06 20:02:55 UTC
Created attachment 134759 [details] [review]
Bug 29925: (follow-up) Add new pref in sysprefs.sql
Comment 18 Fridolin Somers 2022-05-06 20:34:14 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄