|
Lines 83-93
sub authenticate_api_request {
Link Here
|
| 83 |
); |
83 |
); |
| 84 |
} |
84 |
} |
| 85 |
|
85 |
|
| 86 |
if ($action_spec->{'x-koha-permission'}) { |
86 |
if ($action_spec->{'x-koha-authorization'}) { |
| 87 |
if (_allowOwner($c, $action_spec, $user)) { |
87 |
if (_allowOwner($c, $action_spec, $user)) { |
| 88 |
return $next->($c); |
88 |
return $next->($c); |
| 89 |
} |
89 |
} |
| 90 |
my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; |
90 |
my $permissions = $action_spec->{'x-koha-authorization'}->{'permissions'}; |
| 91 |
|
91 |
|
| 92 |
if (C4::Auth::haspermission($user->userid, $permissions)) { |
92 |
if (C4::Auth::haspermission($user->userid, $permissions)) { |
| 93 |
return $next->($c); |
93 |
return $next->($c); |
|
Lines 108-114
sub authenticate_api_request {
Link Here
|
| 108 |
sub _allowOwner { |
108 |
sub _allowOwner { |
| 109 |
my ($c, $action_spec, $user) = @_; |
109 |
my ($c, $action_spec, $user) = @_; |
| 110 |
|
110 |
|
| 111 |
my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; |
111 |
my $allowOwner = $action_spec->{'x-koha-authorization'}->{'allow-owner'}; |
| 112 |
|
112 |
|
| 113 |
return unless $allowOwner && $allowOwner == 1; |
113 |
return unless $allowOwner && $allowOwner == 1; |
| 114 |
if ($c->param("borrowernumber")) { |
114 |
if ($c->param("borrowernumber")) { |