View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons/Holds.pm (+4 lines)
Lines 21-26 use Mojo::Base 'Mojolicious::Controller'; Link Here
21
21
22
use Koha::Patrons;
22
use Koha::Patrons;
23
23
24
use Try::Tiny;
25
24
=head1 NAME
26
=head1 NAME
25
27
26
Koha::REST::V1::Patrons::Holds
28
Koha::REST::V1::Patrons::Holds
Lines 72-77 sub delete_public { Link Here
72
    my $c = shift->openapi->valid_input or return;
74
    my $c = shift->openapi->valid_input or return;
73
75
74
    return try {
76
    return try {
77
        $c->auth->public( $c->param('patron_id') );
78
75
        my $hold = $c->objects->find_rs( Koha::Holds->new, $c->param('hold_id') );
79
        my $hold = $c->objects->find_rs( Koha::Holds->new, $c->param('hold_id') );
76
80
77
        unless ( $hold and $c->param('patron_id') == $hold->borrowernumber ) {
81
        unless ( $hold and $c->param('patron_id') == $hold->borrowernumber ) {
(-)a/api/v1/swagger/paths/public_patrons.yaml (-2 lines)
Lines 278-282 Link Here
278
        description: Under maintenance
278
        description: Under maintenance
279
        schema:
279
        schema:
280
          $ref: "../swagger.yaml#/definitions/error"
280
          $ref: "../swagger.yaml#/definitions/error"
281
    x-koha-authorization:
282
      allow-owner: true
(-)a/t/db_dependent/api/v1/patrons_holds.t (-2 / +10 lines)
Lines 93-99 subtest 'list() tests' => sub { Link Here
93
93
94
subtest 'delete_public() tests' => sub {
94
subtest 'delete_public() tests' => sub {
95
95
96
    plan tests => 13;
96
    plan tests => 18;
97
97
98
    $schema->storage->txn_begin;
98
    $schema->storage->txn_begin;
99
99
Lines 113-123 subtest 'delete_public() tests' => sub { Link Here
113
    my $deleted_hold_id = $hold_to_delete->id;
113
    my $deleted_hold_id = $hold_to_delete->id;
114
    $hold_to_delete->delete;
114
    $hold_to_delete->delete;
115
115
116
    $t->delete_ok( "/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id )->status_is(401)
117
        ->json_is( { error => 'Authentication failure.' } );
118
116
    $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id )
119
    $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id )
117
        ->status_is(404);
120
        ->status_is(404);
118
121
119
    my $another_user_hold = $builder->build_object( { class => 'Koha::Holds' } );
122
    my $another_user_hold = $builder->build_object( { class => 'Koha::Holds' } );
120
123
124
    $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/"
125
            . $another_user_hold->borrowernumber
126
            . '/holds/'
127
            . $another_user_hold->id )
128
        ->json_is( { error => "Unprivileged user cannot access another user's resources" } );
129
121
    $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $another_user_hold->id )
130
    $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $another_user_hold->id )
122
        ->status_is( 404, 'Invalid patron_id and hold_id combination yields 404' );
131
        ->status_is( 404, 'Invalid patron_id and hold_id combination yields 404' );
123
132
124
- 

Return to bug 28907