gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 28097: REST - Remove allow-owner from public password route 

To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t

Observe success in both cases.

https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This commit is contained in:
Lari Taskula 2024-09-18 08:39:48 +00:00 committed by Alex Buckley
parent e810e4c668
commit 441f7b4d07
3 changed files with 38 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
Koha/REST/V1/Patrons/Password.pm
View File

@ -91,34 +91,25 @@ sub set_public {
my $user = $c->stash('koha.user');
unless ( $user->borrowernumber == $patron_id ) {
return $c->render(
status => 403,
openapi => {
error => "Changing other patron's password is forbidden"
}
);
}
unless ( $user->category->effective_change_password ) {
return $c->render(
status => 403,
openapi => {
error => "Changing password is forbidden"
}
);
}
my $old_password = $body->{old_password};
my $password = $body->{password};
my $password_2 = $body->{password_repeated};
unless ( $password eq $password_2 ) {
return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
}
return try {
unless ( checkpw_internal($user->userid, $old_password ) ) {
$c->auth->public($patron_id);
unless ( $user->category->effective_change_password ) {
return $c->render(
status => 403,
openapi => { error => "Changing password is forbidden" }
);
}
my $old_password = $body->{old_password};
my $password = $body->{password};
my $password_2 = $body->{password_repeated};
unless ( $password eq $password_2 ) {
return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
}
unless ( checkpw_internal( $user->userid, $old_password ) ) {
return $c->render(
status => 400,
openapi => { error => "Invalid password" }
@ -126,19 +117,20 @@ sub set_public {
}
## Change password
$user->set_password({ password => $password });
$user->set_password( { password => $password } );
return $c->render( status => 200, openapi => "" );
}
catch {
} catch {
if ( blessed $_ and $_->isa('Koha::Exceptions::Password') ) {
return $c->render(
status => 400,
openapi => { error => "$_" }
);
} elsif ( blessed $_ and $_->isa('Koha::Exceptions::REST::Public::Unauthorized') ) {
return $c->render( status => 403, json => { error => "Changing other patron's password is forbidden" } );
} else {
$c->unhandled_exception($_);
}
$c->unhandled_exception($_);
};
}

2
api/v1/swagger/paths/public_patrons.yaml
View File

@ -60,8 +60,6 @@
description: Under maintenance
schema:
$ref: "../swagger.yaml#/definitions/error"
x-koha-authorization:
allow-owner: true
"/public/patrons/{patron_id}/checkouts":
post:
x-mojo-to: Checkouts#add

16
t/db_dependent/api/v1/patrons_password.t
View File

@ -117,7 +117,7 @@ subtest 'set() (authorized user tests)' => sub {
subtest 'set_public() (unprivileged user tests)' => sub {
plan tests => 18;
plan tests => 21;
$schema->storage->txn_begin;
@ -162,6 +162,18 @@ subtest 'set_public() (unprivileged user tests)' => sub {
}
);
$t->post_ok(
"/api/v1/public/patrons/" . $patron->id . "/password" => json => {
password => $new_password,
password_repeated => $new_password,
old_password => $password
}
)->status_is(401)->json_is(
'/error',
"Authentication failure."
);
t::lib::Mocks::mock_preference( 'OpacPasswordChange', 1 );
$t->post_ok(
@ -174,7 +186,7 @@ subtest 'set_public() (unprivileged user tests)' => sub {
}
)->status_is(403)
->json_is( '/error',
"Authorization failure. Missing required permission(s)." );
"Changing other patron's password is forbidden" );
$t->post_ok(
"//$userid:$password@/api/v1/public/patrons/"