gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 28907: REST - Remove allow-owner from public password route 

To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t

Observe success in both cases.

https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Lari Taskula 2024-09-18 08:39:48 +00:00 committed by Katrin Fischer
parent f648aa453f
commit 3ccf9d4ee1
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
3 changed files with 35 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
Koha/REST/V1/Patrons/Password.pm
View File

@ -90,29 +90,24 @@ sub set_public {
my $user = $c->stash('koha.user');
unless ( $user->borrowernumber == $patron_id ) {
return $c->render(
status => 403,
openapi => { error => "Changing other patron's password is forbidden" }
);
}
unless ( $user->category->effective_change_password ) {
return $c->render(
status => 403,
openapi => { error => "Changing password is forbidden" }
);
}
my $old_password = $body->{old_password};
my $password = $body->{password};
my $password_2 = $body->{password_repeated};
unless ( $password eq $password_2 ) {
return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
}
return try {
$c->auth->public($patron_id);
unless ( $user->category->effective_change_password ) {
return $c->render(
status => 403,
openapi => { error => "Changing password is forbidden" }
);
}
my $old_password = $body->{old_password};
my $password = $body->{password};
my $password_2 = $body->{password_repeated};
unless ( $password eq $password_2 ) {
return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
}
unless ( checkpw_internal( $user->userid, $old_password ) ) {
return $c->render(
status => 400,
@ -130,9 +125,11 @@ sub set_public {
status => 400,
openapi => { error => "$_" }
);
} elsif ( blessed $_ and $_->isa('Koha::Exceptions::REST::Public::Unauthorized') ) {
return $c->render( status => 403, json => { error => "Changing other patron's password is forbidden" } );
} else {
$c->unhandled_exception($_);
}
$c->unhandled_exception($_);
};
}

4
api/v1/swagger/paths/public_patrons.yaml
View File

@ -60,8 +60,6 @@
description: Under maintenance
schema:
$ref: "../swagger.yaml#/definitions/error"
x-koha-authorization:
allow-owner: true
"/public/patrons/{patron_id}/checkouts":
post:
x-mojo-to: Checkouts#add
@ -287,4 +285,4 @@
schema:
$ref: "../swagger.yaml#/definitions/error"
x-koha-authorization:
allow-owner: true
allow-owner: true

15
t/db_dependent/api/v1/patrons_password.t
View File

@ -102,7 +102,7 @@ subtest 'set() (authorized user tests)' => sub {
subtest 'set_public() (unprivileged user tests)' => sub {
plan tests => 18;
plan tests => 21;
$schema->storage->txn_begin;
@ -141,6 +141,17 @@ subtest 'set_public() (unprivileged user tests)' => sub {
}
)->status_is(403)->json_is( { error => 'Changing password is forbidden' } );
$t->post_ok(
"/api/v1/public/patrons/" . $patron->id . "/password" => json => {
password => $new_password,
password_repeated => $new_password,
old_password => $password
}
)->status_is(401)->json_is(
'/error',
"Authentication failure."
);
t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
$t->post_ok(
@ -151,7 +162,7 @@ subtest 'set_public() (unprivileged user tests)' => sub {
}
)->status_is(403)->json_is(
'/error',
"Authorization failure. Missing required permission(s)."
"Changing other patron's password is forbidden"
);
$t->post_ok(