From e82d976ffdba6502ba543de9311cf602a3a97c92 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Fri, 18 Jan 2019 12:02:38 -0300 Subject: [PATCH] Bug 16497: (follow-up) GET operations require staff access With the introduction of the /public namespace all other endpoints, the rest of the endpoints are restricted to privileged users. This patch makes the GET /libraries and GET /libraries/:library_id endpoints require 'catalogue' permissions. Signed-off-by: Tomas Cohen Arazi Signed-off-by: Martin Renvoize --- api/v1/swagger/paths/libraries.json | 10 ++++++++++ t/db_dependent/api/v1/libraries.t | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/api/v1/swagger/paths/libraries.json b/api/v1/swagger/paths/libraries.json index 70249ed227..c4cd55b578 100644 --- a/api/v1/swagger/paths/libraries.json +++ b/api/v1/swagger/paths/libraries.json @@ -152,6 +152,11 @@ "$ref": "../definitions.json#/error" } } + }, + "x-koha-authorization": { + "permissions": { + "catalogue": "1" + } } }, "post": { @@ -253,6 +258,11 @@ "$ref": "../definitions.json#/error" } } + }, + "x-koha-authorization": { + "permissions": { + "catalogue": "1" + } } }, "put": { diff --git a/t/db_dependent/api/v1/libraries.t b/t/db_dependent/api/v1/libraries.t index db76b6dbd0..bd74dd3e34 100644 --- a/t/db_dependent/api/v1/libraries.t +++ b/t/db_dependent/api/v1/libraries.t @@ -48,7 +48,7 @@ subtest 'list() tests' => sub { my $another_library = $library->unblessed; # create a copy of $library but make delete $another_library->{branchcode}; # sure branchcode will be regenerated $another_library = $builder->build_object({ class => 'Koha::Libraries', value => $another_library }); - my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 0 } ); + my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 1 } ); ## Authorized user tests my $count_of_libraries = Koha::Libraries->search->count; @@ -119,7 +119,7 @@ subtest 'get() tests' => sub { my $library = $builder->build_object( { class => 'Koha::Libraries' } ); my ( $borrowernumber, $session_id ) = - create_user_and_session( { authorized => 0 } ); + create_user_and_session( { authorized => 1 } ); my $tx = $t->ua->build_tx( GET => "/api/v1/libraries/" . $library->branchcode ); $tx->req->cookies( { name => 'CGISESSID', value => $session_id } ); -- 2.20.1