Bug 29508 - GET /patrons/:patron_id should use Koha::Patrons->search_limited
Summary: GET /patrons/:patron_id should use Koha::Patrons->search_limited
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Tomás Cohen Arazi
QA Contact:
URL:
Keywords:
Depends on: 29506
Blocks: 29510
  Show dependency treegraph
 
Reported: 2021-11-17 19:27 UTC by Tomás Cohen Arazi
Modified: 2022-12-12 21:24 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.02,21.05.08


Attachments
Bug 29508: Regression tests (3.08 KB, patch)
2021-11-17 19:45 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited (1.20 KB, patch)
2021-11-17 19:45 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29508: Regression tests (3.14 KB, patch)
2021-11-18 07:52 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited (1.26 KB, patch)
2021-11-18 07:52 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 29508: Regression tests (3.20 KB, patch)
2021-12-17 14:21 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited (1.31 KB, patch)
2021-12-17 14:21 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2021-11-17 19:27:22 UTC
Currently there's no check on permissions to see the requested patron, besides generic spec permissions check.
Comment 1 Tomás Cohen Arazi 2021-11-17 19:45:14 UTC
Created attachment 127757 [details] [review]
Bug 29508: Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 Tomás Cohen Arazi 2021-11-17 19:45:18 UTC
Created attachment 127758 [details] [review]
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited

This patch makes the route return 404 if the user is not allowed to see
the requested patron information.

To test:
1. Apply the regression tests
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> FAIL: The code doesn't respect limits
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 3 Martin Renvoize 2021-11-18 07:52:14 UTC
Created attachment 127770 [details] [review]
Bug 29508: Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2021-11-18 07:52:18 UTC
Created attachment 127771 [details] [review]
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited

This patch makes the route return 404 if the user is not allowed to see
the requested patron information.

To test:
1. Apply the regression tests
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> FAIL: The code doesn't respect limits
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2021-11-18 07:52:49 UTC
Great work going through all this Tomas!

Works as expected, tests are thorough and passing.

Signing off
Comment 6 Nick Clemens 2021-12-17 14:21:03 UTC
Created attachment 128671 [details] [review]
Bug 29508: Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Nick Clemens 2021-12-17 14:21:07 UTC
Created attachment 128672 [details] [review]
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited

This patch makes the route return 404 if the user is not allowed to see
the requested patron information.

To test:
1. Apply the regression tests
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> FAIL: The code doesn't respect limits
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 8 Fridolin Somers 2022-01-06 00:03:14 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 9 Kyle M Hall 2022-01-07 11:37:04 UTC
Pushed to 21.11.x for 21.11.02
Comment 10 Andrew Fuerste-Henry 2022-01-11 22:04:22 UTC
Pushed to 21.05.x for 21.05.08
Comment 11 Victor Grousset/tuxayo 2022-02-07 18:53:48 UTC
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.