|
Lines 106-112
sub authenticate_api_request {
Link Here
|
| 106 |
} |
106 |
} |
| 107 |
|
107 |
|
| 108 |
if ($action_spec->{'x-koha-permission'}) { |
108 |
if ($action_spec->{'x-koha-permission'}) { |
| 109 |
if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { |
109 |
if (_allowOwner($c, $action_spec, $user)) { |
|
|
110 |
return $next->($c); |
| 111 |
} |
| 112 |
my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; |
| 113 |
|
| 114 |
if (C4::Auth::haspermission($user->userid, $permissions)) { |
| 110 |
return $next->($c); |
115 |
return $next->($c); |
| 111 |
} |
116 |
} |
| 112 |
else { |
117 |
else { |
|
Lines 122-125
sub authenticate_api_request {
Link Here
|
| 122 |
} |
127 |
} |
| 123 |
} |
128 |
} |
| 124 |
|
129 |
|
|
|
130 |
sub _allowOwner { |
| 131 |
my ($c, $action_spec, $user) = @_; |
| 132 |
|
| 133 |
my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; |
| 134 |
|
| 135 |
return unless $allowOwner && $allowOwner == 1; |
| 136 |
if ($c->param("borrowernumber")) { |
| 137 |
return $c->param("borrowernumber") |
| 138 |
&& $user->borrowernumber == $c->param("borrowernumber"); |
| 139 |
} |
| 140 |
elsif ($c->req->json && $c->req->json->{"borrowernumber"}) { |
| 141 |
return $c->req->json->{"borrowernumber"} |
| 142 |
&& $user->borrowernumber == $c->req->json->{"borrowernumber"}; |
| 143 |
} |
| 144 |
} |
| 145 |
|
| 125 |
1; |
146 |
1; |
| 126 |
- |
|
|