gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 28907: REST - Remove allow-owner from public checkouts route 

To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This commit is contained in:
Lari Taskula 2024-09-18 08:44:46 +00:00 committed by Alex Buckley
parent 441f7b4d07
commit 73283e04f1
3 changed files with 14 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
Koha/REST/V1/Checkouts.pm
View File

@ -27,6 +27,7 @@ use Koha::Checkouts;
use Koha::Old::Checkouts;
use Koha::Token;
use Scalar::Util qw( blessed );
use Try::Tiny qw( catch try );
=head1 NAME
@ -190,19 +191,19 @@ sub add {
my $patron_id = $body->{patron_id};
my $onsite = $body->{onsite_checkout};
if ( $c->stash('is_public')
&& !C4::Context->preference('OpacTrustedCheckout') )
{
return $c->render(
status => 405,
openapi => {
error => 'Feature disabled',
error_code => 'FEATURE_DISABLED'
}
);
}
return try {
if ( $c->stash('is_public') ) {
$c->auth->public($patron_id);
return $c->render(
status => 405,
openapi => {
error => 'Feature disabled',
error_code => 'FEATURE_DISABLED'
}
) if !C4::Context->preference('OpacTrustedCheckout');
}
my $item = Koha::Items->find($item_id);
unless ($item) {
return $c->render(

2
api/v1/swagger/paths/public_patrons.yaml
View File

@ -130,8 +130,6 @@
description: Under maintenance
schema:
$ref: "../swagger.yaml#/definitions/error"
x-koha-authorization:
allow-owner: true
"/public/patrons/{patron_id}/guarantors/can_see_charges":
put:
x-mojo-to: Patrons#guarantors_can_see_charges

3
t/db_dependent/api/v1/checkouts.t
View File

@ -536,8 +536,7 @@ subtest 'add checkout' => sub {
$t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json =>
{ item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is(
{
error => "Authorization failure. Missing required permission(s).",
required_permissions => undef
error => "Unprivileged user cannot access another user's resources"
}
);