View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/ArticleRequests.pm (-12 / +13 lines)
Lines 73-94 Controller function that handles cancelling a patron's Koha::ArticleRequest obje Link Here
73
sub patron_cancel {
73
sub patron_cancel {
74
    my $c = shift->openapi->valid_input or return;
74
    my $c = shift->openapi->valid_input or return;
75
75
76
    my $patron = Koha::Patrons->find( $c->param('patron_id') );
76
    my $patron_id = $c->param('patron_id');
77
    return try {
78
        $c->auth->public($patron_id);
79
        my $patron = Koha::Patrons->find($patron_id);
77
80
78
    return $c->render_resource_not_found("Patron")
81
        return $c->render_resource_not_found("Patron")
79
        unless $patron;
82
            unless $patron;
80
83
81
    # patron_id has been validated by the allow-owner check, so the following call to related
84
        # patron_id has been validated by the $c->auth->public check, so the following call to related
82
    # article requests covers the case of article requests not belonging to the patron
85
        # article requests covers the case of article requests not belonging to the patron
83
    my $article_request = $patron->article_requests->find( $c->param('article_request_id') );
86
        my $article_request = $patron->article_requests->find( $c->param('article_request_id') );
84
87
85
    return $c->render_resource_not_found("Article request")
88
        return $c->render_resource_not_found("Article request")
86
        unless $article_request;
89
            unless $article_request;
87
90
88
    my $reason = $c->param('cancellation_reason');
91
        my $reason = $c->param('cancellation_reason');
89
    my $notes  = $c->param('notes');
92
        my $notes  = $c->param('notes');
90
91
    return try {
92
93
93
        $article_request->cancel(
94
        $article_request->cancel(
94
            {
95
            {
(-)a/api/v1/swagger/paths/article_requests.yaml (-2 lines)
Lines 113-117 Link Here
113
        description: Under maintenance
113
        description: Under maintenance
114
        schema:
114
        schema:
115
          $ref: "../swagger.yaml#/definitions/error"
115
          $ref: "../swagger.yaml#/definitions/error"
116
    x-koha-authorization:
117
      allow-owner: true
(-)a/t/db_dependent/api/v1/article_requests.t (-3 / +6 lines)
Lines 84-90 subtest 'cancel() tests' => sub { Link Here
84
84
85
subtest 'patron_cancel() tests' => sub {
85
subtest 'patron_cancel() tests' => sub {
86
86
87
    plan tests => 14;
87
    plan tests => 17;
88
88
89
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
89
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
90
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
90
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
Lines 116-125 subtest 'patron_cancel() tests' => sub { Link Here
116
116
117
    my $article_request_2 = $builder->build_object({ class => 'Koha::ArticleRequests', value => { borrowernumber => $another_patron_id } });
117
    my $article_request_2 = $builder->build_object({ class => 'Koha::ArticleRequests', value => { borrowernumber => $another_patron_id } });
118
118
119
    # delete another patron's request when unauthorized
120
    $t->delete_ok( "/api/v1/public/patrons/$another_patron_id/article_requests/" . $article_request_2->id )
121
        ->status_is(401)->json_is( '/error' => "Authentication failure." );
122
119
    # delete another patron's request
123
    # delete another patron's request
120
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$another_patron_id/article_requests/" . $article_request_2->id)
124
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$another_patron_id/article_requests/" . $article_request_2->id)
121
      ->status_is(403)
125
      ->status_is(403)
122
      ->json_is( '/error' => 'Authorization failure. Missing required permission(s).' );
126
      ->json_is( '/error' => "Unprivileged user cannot access another user's resources" );
123
127
124
    my $another_article_request = $builder->build_object(
128
    my $another_article_request = $builder->build_object(
125
        {
129
        {
126
- 

Return to bug 28907