LP#1579225: fix handling of passwords in patron registration collab/miker/lp1579225_patron_registration_password_mgmt_signoff2
authorGalen Charlton <gmc@esilibrary.com>
Sat, 7 May 2016 01:40:12 +0000 (21:40 -0400)
committerMike Rylander <mrylander@gmail.com>
Mon, 9 May 2016 16:56:11 +0000 (12:56 -0400)
commite8f64f9fdd724a3aea77c1d93dd8435f63f4970b
tree3f4b65fb25c8cfc3ba8ff241936ab395854e4583
parent2cf65ef923145aade9a6ced615dfd29d4d6216b3
LP#1579225: fix handling of passwords in patron registration

This patch improves how the new password hashing is invoked
by open-ils.actor.patron.update; in particular, it fixes
a problem whereby newly registered patrons could not
log in.  It also fixes other issues:

- actor.usr.passwd would be set to an MD5 of the password
  for new users, vitiating the strong hashes in actor.passwd
- certain types of updates via patron registration, such as
  adding or updating address, could result in the patron's
  password getting doubly-hashed, thereby locking them out
  of their account.

To test
-------
[1] Register a new patron; verify that they can log in.
[2] Edit an existing patron and change their password; verify
    that they can log in.
[3] Edit an existing patron but do NOT change their password;
    verify that they can still log in.
[4] Inspect the actor.usr rows for these patrons and verify
    that actor.usr.passwd is set to the value MD5(''), not
    the MD5 of their password.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Dan Wells <dbw2@calvin.edu>
Signed-off-by: Mike Rylander <mrylander@gmail.com>
Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm