Bug 31555 - Getting holds via REST API needs edit_borrowers permission
Summary: Getting holds via REST API needs edit_borrowers permission
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Johanna Räisä
QA Contact: Kyle M Hall
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-09-13 12:07 UTC by Johanna Räisä
Modified: 2023-12-28 20:43 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.11.00


Attachments
Bug 31555: change holds GET permission to place_holds (2.07 KB, patch)
2022-09-14 06:25 UTC, Johanna Räisä
Details | Diff | Splinter Review
Bug 31555: change holds GET permission to place_holds (2.12 KB, patch)
2022-09-14 12:47 UTC, David Nind
Details | Diff | Splinter Review
Bug 31555: change holds GET permission to place_holds (2.17 KB, patch)
2022-10-07 14:04 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Johanna Räisä 2022-09-13 12:07:41 UTC
Permissions on holds GET endpoint and request.pl are different. Staff member can see holds with place_holds permission and but via REST API it is blocked. Also a staff member can see and modify holds on patron's page without edit_borrowers permission. The GET endpoint should use place_holds permission to be more consistent.
Comment 1 Johanna Räisä 2022-09-14 06:25:39 UTC
Created attachment 140611 [details] [review]
Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy
Comment 2 David Nind 2022-09-14 12:47:09 UTC
Created attachment 140630 [details] [review]
Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Kyle M Hall 2022-10-07 14:04:04 UTC
Created attachment 141503 [details] [review]
Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 4 Tomás Cohen Arazi 2022-10-11 14:19:37 UTC
Our permissions need a revamp (i.e. we should have individual permissions for each hold action).
Comment 5 Tomás Cohen Arazi 2022-10-11 14:21:40 UTC
Pushed to master for 22.11.

Nice work everyone, thanks!