LP#1579225: fix handling of passwords in patron registration
authorGalen Charlton <gmc@esilibrary.com>
Sat, 7 May 2016 01:40:12 +0000 (21:40 -0400)
committerGalen Charlton <gmc@esilibrary.com>
Mon, 9 May 2016 20:43:03 +0000 (16:43 -0400)
commit9f7a5940166f3c94f7d6bd457da521ebfb46a7db
treed6e45a755768eb24c1027d83d2081a946dc1e6c4
parent8069cc6d29077892f4375f56b3a88a0531922a8d
LP#1579225: fix handling of passwords in patron registration

This patch improves how the new password hashing is invoked
by open-ils.actor.patron.update; in particular, it fixes
a problem whereby newly registered patrons could not
log in.  It also fixes other issues:

- actor.usr.passwd would be set to an MD5 of the password
  for new users, vitiating the strong hashes in actor.passwd
- certain types of updates via patron registration, such as
  adding or deleting addresses, could result in the patron's
  password getting doubly-hashed, thereby locking them out
  of their account.

To test
-------
[1] Register a new patron; verify that they can log in.
[2] Edit an existing patron and change their password; verify
    that they can log in.
[3] Edit an existing patron but do NOT change their password;
    verify that they can still log in.
[4] Inspect the actor.usr rows for these patrons and verify
    that actor.usr.passwd is set to the value MD5(''), not
    the MD5 of their password.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Dan Wells <dbw2@calvin.edu>
Signed-off-by: Mike Rylander <mrylander@gmail.com>
Signed-off-by: Kathy Lussier <klussier@masslnc.org>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm