Lines 94-100
sub authenticate_api_request {
Link Here
|
94 |
} |
94 |
} |
95 |
|
95 |
|
96 |
if ($action_spec->{'x-koha-permission'}) { |
96 |
if ($action_spec->{'x-koha-permission'}) { |
97 |
if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { |
97 |
if (_allowOwner($c, $action_spec, $user)) { |
|
|
98 |
return $next->($c); |
99 |
} |
100 |
my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; |
101 |
|
102 |
if (C4::Auth::haspermission($user->userid, $permissions)) { |
98 |
return $next->($c); |
103 |
return $next->($c); |
99 |
} |
104 |
} |
100 |
else { |
105 |
else { |
Lines 110-113
sub authenticate_api_request {
Link Here
|
110 |
} |
115 |
} |
111 |
} |
116 |
} |
112 |
|
117 |
|
|
|
118 |
sub _allowOwner { |
119 |
my ($c, $action_spec, $user) = @_; |
120 |
|
121 |
my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; |
122 |
|
123 |
return unless $allowOwner && $allowOwner == 1; |
124 |
if ($c->param("borrowernumber")) { |
125 |
return $c->param("borrowernumber") |
126 |
&& $user->borrowernumber == $c->param("borrowernumber"); |
127 |
} |
128 |
elsif ($c->req->json && $c->req->json->{"borrowernumber"}) { |
129 |
return $c->req->json->{"borrowernumber"} |
130 |
&& $user->borrowernumber == $c->req->json->{"borrowernumber"}; |
131 |
} |
132 |
} |
133 |
|
113 |
1; |
134 |
1; |
114 |
- |
|
|