Bugzilla – Attachment 56666 Details for
Bug 16330
Add routes to add, update and delete patrons
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 16330: (QA-follow-up) Fix permission for DELETE
Bug-16330-QA-follow-up-Fix-permission-for-DELETE.patch (text/plain), 1.80 KB, created by
Lari Taskula
on 2016-10-19 14:51:39 UTC
(
hide
)
Description:
Bug 16330: (QA-follow-up) Fix permission for DELETE
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2016-10-19 14:51:39 UTC
Size:
1.80 KB
patch
obsolete
>From 5ea05664c4eaff6754a8ab7420823958d899bbe7 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@jns.fi> >Date: Wed, 19 Oct 2016 17:40:42 +0300 >Subject: [PATCH] Bug 16330: (QA-follow-up) Fix permission for DELETE > >DELETE should not be allowed for user himself unless he has borrowers permission. > >Covered by a test. > >To test: >1. Apply patch >2. Run t/db_dependent/api/v1/patrons.t >--- > api/v1/swagger/paths/patrons.json | 2 -- > t/db_dependent/api/v1/patrons.t | 8 +++++++- > 2 files changed, 7 insertions(+), 3 deletions(-) > >diff --git a/api/v1/swagger/paths/patrons.json b/api/v1/swagger/paths/patrons.json >index 39f340a..6b55137 100644 >--- a/api/v1/swagger/paths/patrons.json >+++ b/api/v1/swagger/paths/patrons.json >@@ -223,8 +223,6 @@ > } > }, > "x-koha-authorization": { >- "allow-owner": true, >- "allow-guarantor": true, > "permissions": { > "borrowers": "1" > } >diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t >index 716a2cd..f03f36d 100644 >--- a/t/db_dependent/api/v1/patrons.t >+++ b/t/db_dependent/api/v1/patrons.t >@@ -17,7 +17,7 @@ > > use Modern::Perl; > >-use Test::More tests => 74; >+use Test::More tests => 77; > use Test::Mojo; > use t::lib::TestBuilder; > >@@ -91,6 +91,12 @@ $t->request_ok($tx) > ->status_is(403) > ->json_is('/required_permissions', {"borrowers" => "1"}); > >+$tx = $t->ua->build_tx(DELETE => "/api/v1/patrons/" . $patron->{ borrowernumber }); >+$tx->req->cookies({name => 'CGISESSID', value => $session->id}); >+$t->request_ok($tx) >+ ->status_is(403) >+ ->json_is('/required_permissions', {"borrowers" => "1"}); >+ > # User without permissions, but is the owner of the object > $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $patron->{borrowernumber}); > $tx->req->cookies({name => 'CGISESSID', value => $session->id}); >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16330
:
50803
|
50889
|
51066
|
51131
|
51132
|
53216
|
53217
|
53820
|
54942
|
55147
|
56666
|
56667
|
56668
|
63646
|
63647
|
63649
|
63650
|
69546
|
69547
|
69548
|
69549
|
69550
|
69551
|
69752
|
69762
|
69763
|
69764
|
69765
|
69766
|
69767
|
69768
|
69787
|
70034
|
70035
|
70036
|
70037
|
70038
|
71667
|
71668
|
71669
|
71670
|
71671
|
71920
|
71921
|
71922
|
71923
|
71924
|
71925
|
71933
|
71934
|
71935
|
71936
|
71937
|
71938
|
73434