Lines 111-131
sub authenticate_api_request {
Link Here
|
111 |
|
111 |
|
112 |
# Check if the user is authorized |
112 |
# Check if the user is authorized |
113 |
return $next->($c) if C4::Auth::haspermission($user->userid, $permissions); |
113 |
return $next->($c) if C4::Auth::haspermission($user->userid, $permissions); |
114 |
if (C4::Context->preference("AccessOwnObjectsInAPI")) { |
114 |
my $owner_or_guarantor = allow_owner($c, $authorization, $user) || |
115 |
return $next->($c) if allow_owner($c, $authorization, $user); |
115 |
allow_guarantor($c, $authorization, $user); |
116 |
return $next->($c) if allow_guarantor($c, $authorization, $user); |
116 |
if( C4::Context->preference("AccessOwnObjectsInAPI") ) { |
117 |
} else { |
117 |
return $next->($c) if $owner_or_guarantor; |
118 |
if ($authorization->{'allow-owner'} && allow_owner($c, $authorization, |
118 |
} elsif( $owner_or_guarantor ) { |
119 |
$user) || $authorization->{'allow-guarantor'} && allow_guarantor( |
119 |
# Provide a slightly more specific error message |
120 |
$c, $authorization, $user)) { |
120 |
return $c->render_swagger( |
121 |
return $c->render_swagger( |
121 |
{ error => "Functionality for accessing own objects has been " |
122 |
{ error => "Functionality for accessing own objects has been " |
122 |
."disabled. Permission(s) required to access.", |
123 |
."disabled. Permission(s) required to access.", |
123 |
required_permissions => $permissions }, |
124 |
required_permissions => $permissions }, |
124 |
{}, |
125 |
{}, |
125 |
403 |
126 |
403 |
126 |
); |
127 |
); |
|
|
128 |
} |
129 |
} |
127 |
} |
130 |
return $c->render_swagger( |
128 |
return $c->render_swagger( |
131 |
{ error => "Authorization failure. Missing required permission(s).", |
129 |
{ error => "Authorization failure. Missing required permission(s).", |
132 |
- |
|
|