Koha/REST/V1/Patrons/Password.pm

   1 package Koha::REST::V1::Patrons::Password;
   2
   3 # This file is part of Koha.
   4 #
   5 # Koha is free software; you can redistribute it and/or modify it under the
   6 # terms of the GNU General Public License as published by the Free Software
   7 # Foundation; either version 3 of the License, or (at your option) any later
   8 # version.
   9 #
  10 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
  11 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
  12 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License along
  15 # with Koha; if not, write to the Free Software Foundation, Inc.,
  16 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  17
  18 use Modern::Perl;
  19
  20 use Mojo::Base 'Mojolicious::Controller';
  21
  22 use C4::Auth qw(checkpw_internal);
  23
  24 use Koha::Patrons;
  25
  26 use Scalar::Util qw(blessed);
  27 use Try::Tiny;
  28
  29 =head1 NAME
  30
  31 Koha::REST::V1::Patrons::Password
  32
  33 =head1 API
  34
  35 =head2 Methods
  36
  37 =head3 set
  38
  39 Controller method that sets a patron's password, permission driven
  40
  41 =cut
  42
  43 sub set {
  44
  45     my $c = shift->openapi->valid_input or return;
  46
  47     my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
  48     my $body   = $c->validation->param('body');
  49
  50     unless ($patron) {
  51         return $c->render( status => 404, openapi => { error => "Patron not found." } );
  52     }
  53
  54     my $password   = $body->{password}   // "";
  55     my $password_2 = $body->{password_2} // "";
  56
  57     unless ( $password eq $password_2 ) {
  58         return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
  59     }
  60
  61     return try {
  62
  63         ## Change password
  64         $patron->set_password({ password => $password });
  65
  66         return $c->render( status => 200, openapi => "" );
  67     }
  68     catch {
  69         unless ( blessed $_ && $_->can('rethrow') ) {
  70             return $c->render( status => 500, openapi => { error => "$_" } );
  71         }
  72
  73         # an exception was raised. return 400 with the stringified exception
  74         return $c->render( status => 400, openapi => { error => "$_" } );
  75     };
  76 }
  77
  78 =head3 set_public
  79
  80 Controller method that sets a patron's password, for unprivileged users
  81
  82 =cut
  83
  84 sub set_public {
  85
  86     my $c = shift->openapi->valid_input or return;
  87
  88     my $body      = $c->validation->param('body');
  89     my $patron_id = $c->validation->param('patron_id');
  90
  91     unless ( C4::Context->preference('OpacPasswordChange') ) {
  92         return $c->render(
  93             status  => 403,
  94             openapi => { error => "Configuration prevents password changes by unprivileged users" }
  95         );
  96     }
  97
  98     my $user = $c->stash('koha.user');
  99
 100     unless ( $user->borrowernumber == $patron_id ) {
 101         return $c->render(
 102             status  => 403,
 103             openapi => {
 104                 error => "Changing other patron's password is forbidden"
 105             }
 106         );
 107     }
 108
 109     my $old_password = $body->{old_password};
 110     my $password     = $body->{password};
 111     my $password_2   = $body->{password_repeated};
 112
 113     unless ( $password eq $password_2 ) {
 114         return $c->render( status => 400, openapi => { error => "Passwords don't match" } );
 115     }
 116
 117     return try {
 118         my $dbh = C4::Context->dbh;
 119         unless ( checkpw_internal($dbh, $user->userid, $old_password ) ) {
 120             Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password");
 121         }
 122
 123         ## Change password
 124         $user->set_password($password);
 125
 126         return $c->render( status => 200, openapi => "" );
 127     }
 128     catch {
 129         unless ( blessed $_ && $_->can('rethrow') ) {
 130             return $c->render( status => 500, openapi => { error => "$_" } );
 131         }
 132
 133         # an exception was raised. return 400 with the stringified exception
 134         return $c->render( status => 400, openapi => { error => "$_" } );
 135     };
 136 }
 137
 138 1;