RT#29354: Password Security in Email [v3 merge]

[freeside.git] / FS / FS / ClientAPI / MyAccount.pm

diff --git a/FS/FS/ClientAPI/MyAccount.pm b/FS/FS/ClientAPI/MyAccount.pm
index 88b9ed6..f50b9f1 100644 (file)
--- a/FS/FS/ClientAPI/MyAccount.pm
+++ b/FS/FS/ClientAPI/MyAccount.pm
@@ -634,6 +634,11 @@ sub customer_info_short {
 
   }
 
+  # this is here because this routine is called by both fs_ and ng_ main pages, where it appears
+  # it is not customer-specific, though it is only shown to authenticated customers
+  # it is not currently agent-specific, though at some point it might be
+  $return{'announcement'} = join(' ',$conf->config('selfservice-announcement')) || '';
+
   return { 'error'          => '',
            'custnum'        => $custnum,
            %return,
@@ -2389,7 +2394,7 @@ sub change_pkg {
 
   if ( $conf->exists('signup_server-realtime') ) {
 
-    my $bill_error = _do_bop_realtime( $cust_main, $status, 'no_credit'=>1 );
+    my $bill_error = _do_bop_realtime( $cust_main, $status, 'no_invoice_void'=>1 );
 
     if ($bill_error) {
       $err_or_cust_pkg->suspend;
@@ -2465,8 +2470,12 @@ sub _do_bop_realtime {
 
     my $old_balance = $cust_main->balance;
 
-    my $bill_error =    $cust_main->bill
-                     || $cust_main->apply_payments_and_credits;
+    my @cust_bill;
+    my $bill_error = $cust_main->bill(
+      'return_bill'   => \@cust_bill,
+    );
+
+    $bill_error ||= $cust_main->apply_payments_and_credits;
 
     $bill_error ||= $cust_main->realtime_collect('selfservice' => 1)
       if $cust_main->payby =~ /^(CARD|CHEK)$/;
@@ -2478,14 +2487,14 @@ sub _do_bop_realtime {
             )
        )
     {
-      unless ( $opt{'no_credit'} ) {
-        #this makes sense.  credit is "un-doing" the invoice
-        my $conf = new FS::Conf;
-        $cust_main->credit( sprintf("%.2f", $cust_main->balance-$old_balance ),
-                            'self-service decline',
-                            reason_type=>$conf->config('signup_credit_type'),
-                          );
-        $cust_main->apply_credits( 'order' => 'newest' );
+      unless ( $opt{'no_invoice_void'} ) {
+
+        #this used to apply a credit, but now we can void invoices...
+        foreach my $cust_bill (@cust_bill) {
+          my $voiderror = $cust_bill->void('automatic payment failed');
+          warn "Error voiding cust bill after decline: $voiderror" if $voiderror;
+        }
+
       }
 
       return { 'error' => '_decline', 'bill_error' => $bill_error };
@@ -2938,13 +2947,9 @@ sub myaccount_passwd {
         )
     && ! $svc_acct->check_password($p->{'old_password'});
 
-  $error = 'Password too short.'
-    if length($p->{'new_password'}) < ($conf->config('passwordmin') || 6);
-  $error = 'Password too long.'
-    if length($p->{'new_password'}) > ($conf->config('passwordmax') || 8);
-
-  $svc_acct->set_password($p->{'new_password'});
-  $error ||= $svc_acct->replace();
+  $error ||= $svc_acct->is_password_allowed($p->{'new_password'})
+         ||  $svc_acct->set_password($p->{'new_password'})
+         ||  $svc_acct->replace();
 
   #regular pw change in self-service should change contact pw too, otherwise its
   #way too confusing.  hell its confusing they're separate at all, but alas.
@@ -2953,6 +2958,8 @@ sub myaccount_passwd {
   my $contact = FS::contact->by_selfservice_email($svc_acct->email);
   if ( $contact && $contact->custnum == $custnum ) {
     #svc_acct was successful but this one returns an error?  "shouldn't happen"
+    #don't recheck is_password_allowed here; if the svc_acct password was
+    #legal, that's good enough
     $error ||= $contact->change_password($p->{'new_password'});
   }
 
@@ -3208,8 +3215,9 @@ sub process_reset_passwd {
 
   if ( $svc_acct ) {
 
-    $svc_acct->set_password($p->{'new_password'});
-    my $error = $svc_acct->replace();
+    my $error ||= $svc_acct->is_password_allowed($p->{'new_password'})
+              ||  $svc_acct->set_password($p->{'new_password'})
+              ||  $svc_acct->replace();
 
     return { %$info, 'error' => $error } if $error;
 
@@ -3223,7 +3231,8 @@ sub process_reset_passwd {
 
   if ( $contact ) {
 
-    my $error = $contact->change_password($p->{'new_password'});
+    my $error = $contact->is_password_allowed($p->{'new_password'})
+            ||  $contact->change_password($p->{'new_password'});
 
     return { %$info, 'error' => $error }; # if $error;