@@ -, +, @@ --- .../intranet-tmpl/prog/en/includes/members-toolbar.inc | 2 +- members/apikeys.pl | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -57,7 +57,7 @@ [% END %] [% IF Koha.Preference('RESTOAuth2ClientCredentials') %] - [% IF CAN_user_borrowers_edit_borrowers %] + [% IF CAN_user_superlibrarian OR loggedinusernumber == patron.borrowernumber %]
  • Manage API keys
  • [% ELSE %]
  • Manage API keys
  • --- a/members/apikeys.pl +++ a/members/apikeys.pl @@ -52,6 +52,12 @@ if ( not defined $patron or exit; } +if( $patron_id != $loggedinuser && !C4::Context->IsSuperLibrarian() ) { + # not the owner of the account viewing/editing own API keys, nor superlibrarian -> exit + print $cgi->redirect("/cgi-bin/koha/errors/403.pl"); # escape early + exit; +} + my $op = $cgi->param('op') // ''; if ( $op eq 'generate' or --