Bug 23607 - Make /patrons/:patron_id/account privileged user only
Summary: Make /patrons/:patron_id/account privileged user only
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Tomás Cohen Arazi
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 20942
Blocks: 22218
  Show dependency treegraph
 
Reported: 2019-09-13 13:45 UTC by Tomás Cohen Arazi
Modified: 2020-11-30 21:45 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.05


Attachments
Bug 23607: Make /patrons/:patron_id/account staff only (1.80 KB, patch)
2019-09-13 14:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 23607: Make /patrons/:patron_id/account staff only (1.86 KB, patch)
2019-09-17 19:09 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 23607: Make /patrons/:patron_id/account staff only (1.95 KB, patch)
2019-09-27 07:58 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2019-09-13 13:45:21 UTC

    
Comment 1 Tomás Cohen Arazi 2019-09-13 14:27:27 UTC
Created attachment 92802 [details] [review]
Bug 23607: Make /patrons/:patron_id/account staff only

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 Owen Leonard 2019-09-14 00:56:04 UTC
What is the test plan for this?
Comment 3 Josef Moravec 2019-09-17 19:09:20 UTC
Created attachment 92918 [details] [review]
Bug 23607: Make /patrons/:patron_id/account staff only

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 4 Josef Moravec 2019-09-17 19:11:26 UTC
Tested with this plan:
1) remove two lines from api/v1/swagger/paths/patrons_account.json as in patch
2) prove t/db_dependent/api/v1/patrons_accounts.t
--> it should fails with http status 403
3) git checkout -- api/v1/swagger/paths/patrons_account.json
4) apply patch
5) prove t/db_dependent/api/v1/patrons_accounts.t
--> now it return green
Comment 5 Marcel de Rooy 2019-09-27 07:58:55 UTC
Created attachment 93184 [details] [review]
Bug 23607: Make /patrons/:patron_id/account staff only

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Marcel de Rooy 2019-09-27 08:00:45 UTC
Side note: staff only in the title is a bit confusing, since you can still see it via opac if your user has these two permissions.
Comment 7 Martin Renvoize 2019-09-27 12:59:35 UTC
Nice work!

Pushed to master for 19.11.00
Comment 8 Fridolin Somers 2019-10-08 07:08:51 UTC
Pushed to 19.05.x for 19.05.05
Comment 9 Lucas Gass 2019-10-17 20:16:49 UTC
backported to 18.11.x for 18.11.11