https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Kyle, was this supposed to be here? General public has no access to RT :) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #3 from Jesse Maseto <jesse@bywatersolutions.com> --- This enhancement will provide a secure method for a patron to change their Koha password that does not require any staff mediation. This method would be applicable only to selected patron types, controlled by the library with a setting that the library can change without requesting special assistance. Patrons would be provided with an appropriate link from the OPAC that would lead to a password setting page/UI. Patrons would be required to enter their old password which the system would check to identify and authenticate the patron. New passwords would have to entered twice, would have to match, and would be subject to guidelines for creating passwords (length, required characters, etc.). Alternately, patrons who forget their passwords would be able to recover their account and reset their passwords via email. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com --- Comment #5 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Katrin Fischer from comment #4)

Hi Jesse, thx for the update! But I am not sure how this is different from the existing password reset and password strength features?

It's a level of granularity, not all patrons will be able to reset, just a certain set of them, based on patron type. As kidclamp clarified on IRC: <kidclamp> this is to allow it for only certain categories - very useful in a setting with shib or ldap backing <kidclamp> some patrons should only have they SSO login, others may have a local, they can change via koha <kidclamp> and it adds some notification, so if password is reset we send an email to notify user (in case of fraud!) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Patron Password Resets |Patron password reset by | |category -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #8 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 84596 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=84596&action=edit Bug 21890: Add can_any_reset_password() to the Categories TT plugin This patch introduces a method to the Koha::Template::Plugin::Categories TT plugin. This methods queries for categories that have the can_reset_password flag set, and returns a boolean representing the fact that there's at least one category with the flag set. To test: - Apply this patch - Run: $ kshell k$ prove t/db_dependent/Template/Plugin/Categories.t => SUCCESS: Tests pass! - Sign off :-D Caveat: this patch/tests require the schema to be updated -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #10 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 84598 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=84598&action=edit Bug 21890: Allow restricting password resets by patron category This patch makes the templates relying on the OpacResetPassword syspref use the introduced TT plugin method instead by changing: [% IF Koha.Preference('OpacResetPassword') %] => [% IF Categories.can_any_reset_password %] To test: - Verify that all the places in which the 'forgot password' link is displayed in OPAC keep working, provided there's at least one category that has the flag set - Attempt to recover the password for a patron that belong to a valid category (i.e. that has the flag set) => SUCCESS: You can go through the normal process - Attempt to recover the password for a patron that belongs to a category with the flag unset. => SUCCESS: Once Koha identifies your category, you are told you are not allowed to do it - Sign off :-D -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kyle@bywatersolutions.com |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #84595|0 |1 is obsolete| | Attachment #84596|0 |1 is obsolete| | Attachment #84597|0 |1 is obsolete| | Attachment #84598|0 |1 is obsolete| | --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 84631 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=84631&action=edit Bug 21890: DB updates This patch adds a new column to the categories table: 'can_reset_password' which is a boolean, and represents, well... that. It also deletes the OpacResetPassword system preference, but first sets the OpacResetPassword value to all defined categories as it will be used in the same way. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #13 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 84633 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=84633&action=edit Bug 21890: Handle can_reset_password on the staff interface This patch makes the staff interface handle the new flag when editing the categories. I didn't add the flag to the list of categories table because it makes it too big, but can be easily added if required by users or QA. To test: - Along with other patches from this bug, edit patron categories => SUCCESS: Notice the changes are correctly stored - Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Tomas, I think I would have liked a workflow where the value from the global preference is inherited and can be overwritten on category level a little better as this is yet another thing to remember when setting up patron categories (adding more steps and clicks in most use cases). An example for the different behaviour would be: Block expired patrons. (something to consider) 2) NOT allowed = 1 for the column categories.can_reset_password seems counter intuitive? Please check values. 3) The new column is missing from the category overview page and column configuration. I know others appear to be missing too, but I'd consider this a bug as it means you have to open each one to see where you might have made a wrong choice. 4) The message is: + [% ELSIF errNoBorrowerFound %] + <li>You are not allowed to reset your password. Contact library staff for assistance.</li> [% END %] I think the <li> is wrong here as we are not inside a list and the other message doesn't have it. I think it would be nice to add a span around the message with an id, so if libraries want to change the message it will be easy. The message might read a little harsh to some or they might want to explain. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #84632|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #84634|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #16 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 85001 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=85001&action=edit Bug 21890: DB updates This patch adds a new column to the categories table: 'reset_password' which is a boolean, and represents, well... that. The value itself is nullable. The idea is that OpacResetPassword governs the general behaviour, and this can be overriden at category-level. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #18 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 85003 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=85003&action=edit Bug 21890: Add Koha::Patron::Category->effective_reset_password method This method checks wether the local $self->reset_password is set to override the OpacResetPassword syspref (i.e. if it is set to a bool) or undef, in which case if falls back to the value of the syspref. To test: - Apply this patches - Make sure the DB is updated: $ updatedatabase - Update the schema files: $ dbic - Run: $ kshell k$ prove t/db_dependent/Koha/Patron/Category.t => SUCCESS: Tests pass! - Sign off :-D -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #20 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 85005 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=85005&action=edit Bug 21890: Allow restricting password resets by patron category This patch makes the templates relying on the OpacResetPassword syspref use the introduced TT plugin method instead by changing: [% IF Koha.Preference('OpacResetPassword') %] => [% IF Categories.can_any_reset_password %] To test: - Verify that all the places in which the 'forgot password' link is displayed in OPAC keep working, provided there's at least one category that has the flag set - Attempt to recover the password for a patron that belong to a valid category (i.e. that has the flag set) => SUCCESS: You can go through the normal process - Attempt to recover the password for a patron that belongs to a category with the flag unset. => SUCCESS: Once Koha identifies your category, you are told you are not allowed to do it - Sign off :-D -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #22 from Tomás Cohen Arazi <tomascohen@gmail.com> --- I reworked this so: - reset_password is a nullable bool. Null means global setting is picked, so 0/1 override global, as requested in comment #1 - #2 is solved, silly mistake - #3 Will deal with it in a follow-up bug. Can do here if blocker. But there will be another similar bug for password changes... I prefer to solve it for both in a separate bug. - #4 Solved! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #23 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Hold on! Idiomatic issues: I use 'reset' in spanish usually in the context of the 'forgot password' scenario, and I mixed things :-D. The feature is sound, but every place it says 'reset it should say 'recovery'. I will submit a follow-up fixing this mix. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz --- Comment #24 from Tomás Cohen Arazi <tomascohen@gmail.com> --- *** Bug 3032 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #25 from Tomás Cohen Arazi <tomascohen@gmail.com> --- With help from Katrin, I decided to keep it as-is, as it is consistent with how things are named on the UI and the controlling (existing) sysprefs: - OpacPasswordReset - OpacChangePassword -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #85006|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #85001|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #85003|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #85005|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #28 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 86844 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=86844&action=edit Bug 21890: Handle can_reset_password on the staff interface This patch makes the staff interface handle the new flag when editing the categories. I didn't add the flag to the list of categories table because it makes it too big, but can be easily added if required by users or QA. To test: - Along with other patches from this bug, edit patron categories => SUCCESS: Notice the changes are correctly stored - Sign off :-D -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #30 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 86846 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=86846&action=edit Bug 21890: Add can_any_reset_password() to the Categories TT plugin This patch introduces a method to the Koha::Template::Plugin::Categories TT plugin. This methods queries for categories filtering them by effective_reset_password flag set, and returns a boolean representing the fact that there's at least one category allowed. To test: - Apply this patch - Run: $ kshell k$ prove t/db_dependent/Template/Plugin/Categories.t => SUCCESS: Tests pass! - Sign off :-D Caveat: this patch/tests require the schema to be updated -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #32 from Tomás Cohen Arazi <tomascohen@gmail.com> --- I resubmitted after checking some merge conflicts. I removed the DBIC update so run: $ dbic on kohadevbox to regenerate them on testing. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #86843|0 |1 is obsolete| | Attachment #86844|0 |1 is obsolete| | Attachment #86845|0 |1 is obsolete| | Attachment #86846|0 |1 is obsolete| | Attachment #86847|0 |1 is obsolete| | --- Comment #33 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 86866 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=86866&action=edit Bug 21890: DB updates This patch adds a new column to the categories table: 'reset_password' which is a boolean, and represents, well... that. The value itself is nullable. The idea is that OpacResetPassword governs the general behaviour, and this can be overriden at category-level. Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #35 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 86868 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=86868&action=edit Bug 21890: Add Koha::Patron::Category->effective_reset_password method This method checks wether the local $self->reset_password is set to override the OpacResetPassword syspref (i.e. if it is set to a bool) or undef, in which case if falls back to the value of the syspref. To test: - Apply this patches - Make sure the DB is updated: $ updatedatabase - Update the schema files: $ dbic - Run: $ kshell k$ prove t/db_dependent/Koha/Patron/Category.t => SUCCESS: Tests pass! - Sign off :-D Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #37 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 86870 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=86870&action=edit Bug 21890: Allow restricting password resets by patron category This patch makes the templates relying on the OpacResetPassword syspref use the introduced TT plugin method instead by changing: [% IF Koha.Preference('OpacResetPassword') %] => [% IF Categories.can_any_reset_password %] To test: - Verify that all the places in which the 'forgot password' link is displayed in OPAC keep working, provided there's at least one category that has the flag set - Attempt to recover the password for a patron that belong to a valid category (i.e. that has the flag set) => SUCCESS: You can go through the normal process - Attempt to recover the password for a patron that belongs to a category with the flag unset. => SUCCESS: Once Koha identifies your category, you are told you are not allowed to do it - Sign off :-D Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #39 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 86911 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=86911&action=edit Bug 21890: Wrap message in span Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #86866|0 |1 is obsolete| | --- Comment #41 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 87289 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=87289&action=edit Bug 21890: DB updates This patch adds a new column to the categories table: 'reset_password' which is a boolean, and represents, well... that. The value itself is nullable. The idea is that OpacResetPassword governs the general behaviour, and this can be overriden at category-level. Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #86868|0 |1 is obsolete| | --- Comment #43 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 87291 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=87291&action=edit Bug 21890: Add Koha::Patron::Category->effective_reset_password method This method checks wether the local $self->reset_password is set to override the OpacResetPassword syspref (i.e. if it is set to a bool) or undef, in which case if falls back to the value of the syspref. To test: - Apply this patches - Make sure the DB is updated: $ updatedatabase - Update the schema files: $ dbic - Run: $ kshell k$ prove t/db_dependent/Koha/Patron/Category.t => SUCCESS: Tests pass! - Sign off :-D Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #86870|0 |1 is obsolete| | --- Comment #45 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 87293 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=87293&action=edit Bug 21890: Allow restricting password resets by patron category This patch makes the templates relying on the OpacResetPassword syspref use the introduced TT plugin method instead by changing: [% IF Koha.Preference('OpacResetPassword') %] => [% IF Categories.can_any_reset_password %] To test: - Verify that all the places in which the 'forgot password' link is displayed in OPAC keep working, provided there's at least one category that has the flag set - Attempt to recover the password for a patron that belong to a valid category (i.e. that has the flag set) => SUCCESS: You can go through the normal process - Attempt to recover the password for a patron that belongs to a category with the flag unset. => SUCCESS: Once Koha identifies your category, you are told you are not allowed to do it - Sign off :-D Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 --- Comment #47 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 87295 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=87295&action=edit Bug 21890: (QA follow-up) Use List::Util::any When possible it's a good idea to use `any` from List::Util to shortcut on the first occurence of a truthy value. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |Libraries can now specify release notes| |which patrons are allowed | |to change their password | |through the Forgotten | |Password functionality in | |the OPAC, per patron | |category. A common use case | |for this would be a system | |that combines LDAP (or | |other external | |authentication) patrons and | |local Koha patrons. This | |feature will allow | |libraries to present a | |better user experience for | |password management to all | |of their patrons, no matter | |how they are authenticated. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com Status|Passed QA |Pushed to Master --- Comment #49 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 19.05 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |19.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21890 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|release-notes-needed | -- You are receiving this mail because: You are watching all bug changes.