View | Details | Raw Unified | Return to bug 17424
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-16 / +13 lines)
Lines 111-131 sub authenticate_api_request { Link Here
111
111
112
    # Check if the user is authorized
112
    # Check if the user is authorized
113
    return $next->($c) if C4::Auth::haspermission($user->userid, $permissions);
113
    return $next->($c) if C4::Auth::haspermission($user->userid, $permissions);
114
    if (C4::Context->preference("AccessOwnObjectsInAPI")) {
114
    my $owner_or_guarantor = allow_owner($c, $authorization, $user) ||
115
        return $next->($c) if allow_owner($c, $authorization, $user);
115
        allow_guarantor($c, $authorization, $user);
116
        return $next->($c) if allow_guarantor($c, $authorization, $user);
116
    if( C4::Context->preference("AccessOwnObjectsInAPI") ) {
117
    } else {
117
        return $next->($c) if $owner_or_guarantor;
118
        if ($authorization->{'allow-owner'} && allow_owner($c, $authorization,
118
    } elsif( $owner_or_guarantor ) {
119
            $user) || $authorization->{'allow-guarantor'} && allow_guarantor(
119
        # Provide a slightly more specific error message
120
            $c, $authorization, $user)) {
120
        return $c->render_swagger(
121
                return $c->render_swagger(
121
            { error => "Functionality for accessing own objects has been "
122
                { error => "Functionality for accessing own objects has been "
122
                        ."disabled. Permission(s) required to access.",
123
                            ."disabled. Permission(s) required to access.",
123
            required_permissions => $permissions },
124
                required_permissions => $permissions },
124
            {},
125
                {},
125
            403
126
                403
126
        );
127
            );
128
        }
129
    }
127
    }
130
    return $c->render_swagger(
128
    return $c->render_swagger(
131
        { error => "Authorization failure. Missing required permission(s).",
129
        { error => "Authorization failure. Missing required permission(s).",
132
- 

Return to bug 17424