Enable password recovery when using ILS Authentication

config/vufind/SierraRest.ini

@@ -59,6 +59,9 @@ use_prefixed_ids = false
 ; used (redirect_uri above is not set).
 username_field = "code"
 password_field = "pin"
+; Some library systems use a four digit access pin. Others prefer to have alpha numeric
+; passwords. set digits_only to true for pin functionality. Default is false (alpha-num).
+digits_only = true
 ; Authentication method to use with global patron data access. Default is "native".
 ; "ldap" is supported for REST API v6 and later (see api_version above).
 ; IMPORTANT: when using "native" authentication, the driver assumes by default that

module/VuFind/src/VuFind/Auth/ILS.php

@@ -113,6 +113,23 @@ public function authenticate($request)
         return $this->handleLogin($username, $password, $loginMethod, $rememberMe);
     }
 
+    /**
+     * Does this authentication method support password recovery
+     *
+     * @return bool
+     */
+    public function supportsPasswordRecovery()
+    {
+        $driver = $this->getCatalog()->getDriver();
+        if (
+            method_exists($driver, 'recoverPassword')
+            && ($this->config['Authentication']['recover_password'] ?? false)
+        ) {
+            return true;
+        }
+        return false;
+    }
+
     /**
      * Does this authentication method support password changing
      *
@@ -166,8 +183,13 @@ public function updatePassword($request)
         foreach (['oldpwd', 'password', 'password2'] as $param) {
             $params[$param] = $request->getPost()->get($param, '');
         }
-
         // Connect to catalog:
+        if ($hash = $request->getPost('hash') ?? false) {
+            if ($user = $this->getDbService(UserServiceInterface::class)->getUserByVerifyHash($hash)) {
+                $username = $user->getUsername();
+            }
+        }
+
         if (!($patron = $this->authenticator->storedCatalogLogin())) {
             throw new AuthException('authentication_error_technical');
         }
@@ -178,6 +200,55 @@ public function updatePassword($request)
         $result = $this->getCatalog()->changePassword(
             [
                 'patron' => $patron,
+                'username' => $patron['cat_username'],
+                'oldPassword' => $params['oldpwd'],
+                'newPassword' => $params['password'],
+            ]
+        );
+        if (!$result['success']) {
+            throw new AuthException($result['status']);
+        }
+
+        // Update the user and send it back to the caller:
+        $username = $patron[$this->getUsernameField()];
+        $user = $this->getOrCreateUserByUsername($username);
+        $this->authenticator->saveUserCatalogCredentials($user, $patron['cat_username'], $params['password']);
+        return $user;
+    }
+
+    /**
+     * Change/Reset a user's password when they've forgotten.
+     *
+     * @param Request $request Request object containing new account details.
+     *
+     * @return UserEntityInterface Updated user entity.
+     *
+     * @throws PasswordSecurity
+     * @throws AuthException
+     * @throws \Exception
+     */
+    public function newPassword($request)
+    {
+        foreach (['oldpwd', 'password', 'password2'] as $param) {
+            $params[$param] = $request->getPost()->get($param, '');
+        }
+        // Connect to catalog:
+        if ($hash = $request->getPost('hash') ?? false) {
+            if ($user = $this->getDbService(UserServiceInterface::class)->getUserByVerifyHash($hash)) {
+                $username = $user->getUsername();
+            }
+        }
+        if (!($patron = $this->authenticator->storedCatalogLogin($username ?? null))) {
+            throw new AuthException('authentication_error_technical');
+        }
+        $this->validatePasswordUpdate($params);
+        if (empty($params['oldpwd'])) {
+            $params['oldpwd'] = $patron['cat_password'];
+        }
+        $result = $this->getCatalog()->recoverPassword(
+            [
+                'patron' => $patron,
+                'username' => $patron['cat_username'],
                 'oldPassword' => $params['oldpwd'],
                 'newPassword' => $params['password'],
             ]

module/VuFind/src/VuFind/Auth/ILSAuthenticator.php

@@ -29,9 +29,8 @@
 
 namespace VuFind\Auth;
 
-use Laminas\Config\Config;
-use Laminas\Crypt\BlockCipher;
-use Laminas\Crypt\Symmetric\Openssl;
+use Closure;
+use VuFind\Config\Config;
 use VuFind\Db\Entity\UserEntityInterface;
 use VuFind\Db\Service\DbServiceAwareInterface;
 use VuFind\Db\Service\DbServiceAwareTrait;
@@ -53,13 +52,6 @@ class ILSAuthenticator implements DbServiceAwareInterface
 {
     use DbServiceAwareTrait;
 
-    /**
-     * Callback for retrieving the authentication manager
-     *
-     * @var callable
-     */
-    protected $authManagerCallback;
-
     /**
      * Authentication manager
      *
@@ -91,18 +83,19 @@ class ILSAuthenticator implements DbServiceAwareInterface
     /**
      * Constructor
      *
-     * @param callable            $authCB             Auth manager callback
-     * @param ILSConnection       $catalog            ILS connection
-     * @param ?EmailAuthenticator $emailAuthenticator Email authenticator
-     * @param ?Config             $config             Configuration from config.ini
+     * @param Closure             $authManagerCallback Auth manager callback
+     * @param Closure             $cipherFactory       BlockCipher object factory (takes algorithm as argument)
+     * @param ILSConnection       $catalog             ILS connection
+     * @param ?EmailAuthenticator $emailAuthenticator  Email authenticator
+     * @param ?Config             $config              Configuration from config.ini
      */
     public function __construct(
-        callable $authCB,
+        protected Closure $authManagerCallback,
+        protected Closure $cipherFactory,
         protected ILSConnection $catalog,
         protected ?EmailAuthenticator $emailAuthenticator = null,
         protected ?Config $config = null
     ) {
-        $this->authManagerCallback = $authCB;
     }
 
     /**
@@ -163,7 +156,7 @@ protected function encryptOrDecrypt(?string $text, bool $encrypt = true)
             return null;
         }
 
-        $configAuth = $this->config->Authentication ?? new \Laminas\Config\Config([]);
+        $configAuth = $this->config->Authentication ?? new Config([]);
 
         // Load encryption key from configuration if not already present:
         if ($this->encryptionKey === null) {
@@ -181,7 +174,7 @@ protected function encryptOrDecrypt(?string $text, bool $encrypt = true)
 
         // Check if OpenSSL error is caused by blowfish support
         try {
-            $cipher = new BlockCipher(new Openssl(['algorithm' => $algo]));
+            $cipher = ($this->cipherFactory)($algo);
             if ($algo == 'blowfish') {
                 trigger_error(
                     'Deprecated encryption algorithm (blowfish) detected',
@@ -309,11 +302,12 @@ public function getStoredCatalogCredentials()
      * fails, clear the user's stored credentials so they can enter new, corrected
      * ones.
      *
-     * Returns associative array of patron data on success, false on failure.
+     * @param $userName - the username/barcode for ILS password reset
      *
-     * @return array|bool
+     * @return array|bool Returns associative array of patron data on success,
+     * false on failure.
      */
-    public function storedCatalogLogin()
+    public function storedCatalogLogin($userName = null)
     {
         // Fail if no username is found, but allow a missing password (not every ILS
         // requires a password to connect).
@@ -336,8 +330,22 @@ public function storedCatalogLogin()
                 $this->ilsAccount[$username] = $patron;
                 return $patron;
             }
+        } elseif (!empty($userName)) {
+            if (isset($this->ilsAccount[$userName])) {
+                return $this->ilsAccount[$userName];
+            }
+            $user = $this->getDbService(UserServiceInterface::class)->getUserByUsername($userName);
+            if (empty($user)) {
+                return false;
+            }
+            $patron = $this->catalog->patronLogin($userName, $this->getCatPasswordForUser($user));
+            if (empty($patron)) {
+                $user->setCatUsername(null)->setRawCatPassword(null)->setCatPassEnc(null);
+            } else {
+                $this->ilsAccount[$userName] = $patron;
+                return $patron;
+            }
         }
-
         return false;
     }
 
@@ -347,9 +355,9 @@ public function storedCatalogLogin()
      * @param string $username Catalog username
      * @param string $password Catalog password
      *
-     * Returns associative array of patron data on success, false on failure.
+     * @return array|bool Returns associative array of patron data on success,
+     * false on failure.
      *
-     * @return array|bool
      * @throws ILSException
      */
     public function newCatalogLogin($username, $password)

module/VuFind/src/VuFind/Auth/Manager.php

@@ -29,9 +29,9 @@
 
 namespace VuFind\Auth;
 
-use Laminas\Config\Config;
 use Laminas\Session\SessionManager;
 use LmcRbacMvc\Identity\IdentityInterface;
+use VuFind\Config\Config;
 use VuFind\Cookie\CookieManager;
 use VuFind\Db\Entity\UserEntityInterface;
 use VuFind\Db\Service\UserServiceInterface;
@@ -204,6 +204,19 @@ public function supportsRecovery($authMethod = null)
             && $this->getAuth($authMethod)->supportsPasswordRecovery();
     }
 
+    /**
+     * Multi-ILS Only, Does the target Auth Method support password Recovery?
+     *
+     * @param $target string the target to check against
+     *
+     * @return bool
+     */
+    public function multiSupportsPasswordRecovery($target)
+    {
+        return ($this->config->Authentication->recover_password ?? false)
+            && $this->getAuth()->supportsPasswordRecovery($target);
+    }
+
     /**
      * Is email changing currently allowed?
      *
@@ -670,6 +683,22 @@ public function updatePassword($request)
         return $user;
     }
 
+    /**
+     * Reset a user's password from the request.
+     *
+     * @param \Laminas\Http\PhpEnvironment\Request $request Request object containing
+     * password change details.
+     *
+     * @throws AuthException
+     * @return UserEntityInterface Updated user entity.
+     */
+    public function newPassword($request)
+    {
+        $user = $this->getAuth()->newPassword($request);
+        $this->updateSession($user);
+        return $user;
+    }
+
     /**
      * Update a user's email from the request.
      *

module/VuFind/src/VuFind/Auth/MultiILS.php

@@ -34,6 +34,7 @@
 
 use VuFind\Db\Entity\UserEntityInterface;
 use VuFind\Exception\Auth as AuthException;
+use VuFind\ILS\Connection;
 use VuFind\ILS\Driver\MultiBackend;
 
 use function in_array;
@@ -123,4 +124,24 @@ public function setCatalog(\VuFind\ILS\Connection $connection)
         }
         parent::setCatalog($connection);
     }
+
+    /**
+     * Test to see if the target ILS supports password Recovery
+     *
+     * @param string $target The ILS we are checking
+     *
+     * @return bool
+     *
+     * @throws \Exception
+     */
+    public function supportsPasswordRecovery($target = null)
+    {
+        $catalog = $this->getCatalog();
+        $driver = $catalog->getDriver();
+        $targetDriver = $driver;
+        if ($target != null) {
+            $targetDriver = $driver->getDriverFromTarget($target);
+        }
+        return $targetDriver->supportsMethod('recoverPassword', []) ?? false;
+    }
 }

module/VuFind/src/VuFind/Controller/AbstractBase.php

@@ -36,6 +36,7 @@
 use Laminas\ServiceManager\ServiceLocatorInterface;
 use Laminas\Uri\Http;
 use Laminas\View\Model\ViewModel;
+use VuFind\Config\Feature\EmailSettingsTrait;
 use VuFind\Controller\Feature\AccessPermissionInterface;
 use VuFind\Db\Entity\UserEntityInterface;
 use VuFind\Exception\Auth as AuthException;
@@ -77,6 +78,7 @@
  */
 class AbstractBase extends AbstractActionController implements AccessPermissionInterface, TranslatorAwareInterface
 {
+    use EmailSettingsTrait;
     use GetServiceTrait;
     use TranslatorAwareTrait;
 
@@ -266,7 +268,7 @@ protected function createEmailViewModel($params = null, $defaultSubject = null)
         // Fail if we're missing a from and the form element is disabled:
         if ($view->disableFrom) {
             if (empty($view->from)) {
-                $view->from = $config->Site->email;
+                $view->from = $this->getEmailSenderAddress($config);
             }
             if (empty($view->from)) {
                 throw new \Exception('Unable to determine email from address');
@@ -449,7 +451,7 @@ protected function catalogLogin()
      *
      * @param string $id Configuration identifier (default = main VuFind config)
      *
-     * @return \Laminas\Config\Config
+     * @return \VuFind\Config\Config
      */
     public function getConfig($id = 'config')
     {
@@ -710,6 +712,14 @@ protected function setFollowupUrlToReferer(bool $allowCurrentUrl = true, array $
         if ($mrhuNorm === $refererNorm) {
             return;
         }
+        // if  is the stored current url of the lightbox
+        // which overrides the url from the server request when present
+        $normReferer = $this->normalizeUrlForComparison($referer);
+        $myUserReset = $this->getServerUrl('myresearch-verify');
+        $murNorm = $this->normalizeUrlForComparison($myUserReset);
+        if (str_starts_with($normReferer, $murNorm)) {
+            return;
+        }
 
         // If the referer is the MyResearch/UserLogin action, it probably means
         // that the user is repeatedly mistyping their password. We should
@@ -868,12 +878,19 @@ protected function getILSLoginSettings()
      * Construct an HTTP 205 (refresh) response. Useful for reporting success
      * in the lightbox without actually rendering content.
      *
+     * @param bool $forceGet If true, sends a custom header indicating that the page should be reloaded with a GET
+     * request. This can be useful when it is known that the current page only receives transient params in a POST
+     * request (such as canceling of holds).
+     *
      * @return \Laminas\Http\Response
      */
-    protected function getRefreshResponse()
+    protected function getRefreshResponse(bool $forceGet = false)
     {
         $response = $this->getResponse();
         $response->setStatusCode(205);
+        if ($forceGet) {
+            $response->getHeaders()->addHeaderLine('X-VuFind-Refresh-Method', 'GET');
+        }
         return $response;
     }