password policy enforcement for contacts, #32456

[freeside.git] / FS / FS / contact.pm

diff --git a/FS/FS/contact.pm b/FS/FS/contact.pm
index 7e474f1..d906dc9 100644 (file)
--- a/FS/FS/contact.pm
+++ b/FS/FS/contact.pm
@@ -1,5 +1,6 @@
 package FS::contact;
-use base qw( FS::Record );
+use base qw( FS::Password_Mixin
+             FS::Record );
 
 use strict;
 use vars qw( $skip_fuzzyfiles );
@@ -129,6 +130,8 @@ sub insert {
   my $dbh = dbh;
 
   my $error = $self->SUPER::insert;
+  $error ||= $self->insert_password_history;
+
   if ( $error ) {
     $dbh->rollback if $oldAutoCommit;
     return $error;
@@ -179,7 +182,7 @@ sub insert {
     }
   }
 
-  if ( $self->selfservice_access ) {
+  if ( $self->selfservice_access && ! length($self->_password) ) {
     my $error = $self->send_reset_email( queue=>1 );
     if ( $error ) {
       $dbh->rollback if $oldAutoCommit;
@@ -268,6 +271,9 @@ sub replace {
   my $dbh = dbh;
 
   my $error = $self->SUPER::replace($old);
+  if ( $old->_password ne $self->_password ) {
+    $error ||= $self->insert_password_history;
+  }
   if ( $error ) {
     $dbh->rollback if $oldAutoCommit;
     return $error;
@@ -283,8 +289,11 @@ sub replace {
              );
     my $contact_phone = qsearchs('contact_phone', \%cp);
 
-    # if new value is empty, delete old entry
-    if (!$self->get($pf)) {
+    my $pv = $self->get($pf);
+       $pv =~ s/\s//g;
+
+    #if new value is empty, delete old entry
+    if (!$pv) {
       if ($contact_phone) {
         $error = $contact_phone->delete;
         if ( $error ) {
@@ -297,7 +306,7 @@ sub replace {
 
     $contact_phone ||= new FS::contact_phone \%cp;
 
-    my %cpd = _parse_phonestring( $self->get($pf) );
+    my %cpd = _parse_phonestring( $pv );
     $contact_phone->set( $_ => $cpd{$_} ) foreach keys %cpd;
 
     my $method = $contact_phone->contactphonenum ? 'replace' : 'insert';
@@ -604,9 +613,22 @@ sub authenticate_password {
 
 }
 
+=item change_password NEW_PASSWORD
+
+Changes the contact's selfservice access password to NEW_PASSWORD. This does
+not check password policy rules (see C<is_password_allowed>) and will return
+an error only if editing the record fails for some reason.
+
+If NEW_PASSWORD is the same as the existing password, this does nothing.
+
+=cut
+
 sub change_password {
   my($self, $new_password) = @_;
 
+  # do nothing if the password is unchanged
+  return if $self->authenticate_password($new_password);
+
   $self->change_password_fields( $new_password );
 
   $self->replace;