View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Checkouts.pm (-12 / +13 lines)
Lines 27-32 use Koha::Checkouts; Link Here
27
use Koha::Old::Checkouts;
27
use Koha::Old::Checkouts;
28
use Koha::Token;
28
use Koha::Token;
29
29
30
use Scalar::Util qw( blessed );
30
use Try::Tiny qw( catch try );
31
use Try::Tiny qw( catch try );
31
32
32
=head1 NAME
33
=head1 NAME
Lines 190-208 sub add { Link Here
190
    my $patron_id = $body->{patron_id};
191
    my $patron_id = $body->{patron_id};
191
    my $onsite    = $body->{onsite_checkout};
192
    my $onsite    = $body->{onsite_checkout};
192
193
193
    if ( $c->stash('is_public')
194
        && !C4::Context->preference('OpacTrustedCheckout') )
195
    {
196
        return $c->render(
197
            status  => 405,
198
            openapi => {
199
                error      => 'Feature disabled',
200
                error_code => 'FEATURE_DISABLED'
201
            }
202
        );
203
    }
204
205
    return try {
194
    return try {
195
        if ( $c->stash('is_public') ) {
196
            $c->auth->public($patron_id);
197
198
            return $c->render(
199
                status  => 405,
200
                openapi => {
201
                    error      => 'Feature disabled',
202
                    error_code => 'FEATURE_DISABLED'
203
                }
204
            ) if !C4::Context->preference('OpacTrustedCheckout');
205
        }
206
206
        my $item = Koha::Items->find($item_id);
207
        my $item = Koha::Items->find($item_id);
207
        unless ($item) {
208
        unless ($item) {
208
            return $c->render(
209
            return $c->render(
(-)a/api/v1/swagger/paths/public_patrons.yaml (-2 lines)
Lines 130-137 Link Here
130
        description: Under maintenance
130
        description: Under maintenance
131
        schema:
131
        schema:
132
          $ref: "../swagger.yaml#/definitions/error"
132
          $ref: "../swagger.yaml#/definitions/error"
133
    x-koha-authorization:
134
      allow-owner: true
135
"/public/patrons/{patron_id}/guarantors/can_see_charges":
133
"/public/patrons/{patron_id}/guarantors/can_see_charges":
136
  put:
134
  put:
137
    x-mojo-to: Patrons#guarantors_can_see_charges
135
    x-mojo-to: Patrons#guarantors_can_see_charges
(-)a/t/db_dependent/api/v1/checkouts.t (-3 / +1 lines)
Lines 536-543 subtest 'add checkout' => sub { Link Here
536
        $t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json =>
536
        $t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json =>
537
                { item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is(
537
                { item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is(
538
            {
538
            {
539
                error                => "Authorization failure. Missing required permission(s).",
539
                error => "Unprivileged user cannot access another user's resources"
540
                required_permissions => undef
541
            }
540
            }
542
                );
541
                );
543
542
544
- 

Return to bug 28907