Attachment #74498 for bug #20612

View | Details | Raw Unified | Return to bug 20612
Collapse All | Expand All





use Modern::Perl;

use Koha::ApiKeys;
use Koha::OAuthAccessTokens;

=head1 NAME

sub _verify_client_cb {
    my (%args) = @_;

    my ($client_id, $client_secret) = @args{ qw/ client_id client_secret / };
        = @args{ qw/ client_id client_secret / };

    my $api_key;

    if ($client_id) {
        $api_key = Koha::ApiKeys->find( $client_id );
    }

    # client_id mandatory and exists on the DB
    return (0, 'unauthorized_client') unless $api_key && $api_key->active;

    return (0, 'access_denied') unless $api_key->secret eq $client_secret;

    return (1, undef, []);
}




use C4::Auth qw( check_cookie_auth get_session haspermission );
use C4::Context;

use Koha::ApiKeys;
use Koha::Account::Lines;
use Koha::Checkouts;
use Koha::Holds;
use Koha::OAuth;
use Koha::OAuthAccessTokens;
use Koha::Old::Checkouts;
use Koha::Patrons;


        );

        if ($valid_token) {
            my $patron_id   = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id;
            my $patron      = Koha::Patrons->find($patron_id);
            my ($client) = grep { $_->{client_id} eq $valid_token->{client_id} } @$clients;

            my $patron = Koha::Patrons->find($client->{patron_id});
            my $permissions = $authorization->{'permissions'};
            # Check if the patron is authorized
            if ( haspermission($patron->userid, $permissions)
- 

Return to bug 20612

Lines 17-22 package Koha::OAuth; Link Here

(-)a/Koha/OAuth.pm (-8 / +10 lines)
17		17
18	use Modern::Perl;	18	use Modern::Perl;
19		19
		20	use Koha::ApiKeys;
20	use Koha::OAuthAccessTokens;	21	use Koha::OAuthAccessTokens;
21		22
22	=head1 NAME	23	=head1 NAME
Lines 53-69 and allowed to get authorization. Link Here
53	sub _verify_client_cb {	54	sub _verify_client_cb {
54	my (%args) = @_;	55	my (%args) = @_;
55		56
56	my ($client_id, $client_secret)	57	my ($client_id, $client_secret) = @args{ qw/ client_id client_secret / };
57	= @args{ qw/ client_id client_secret / };
58		58
59	return (0, 'unauthorized_client') unless $client_id;	59	my $api_key;
60		60
61	my $clients = C4::Context->config('api_client');	61	if ($client_id) {
62	$clients = [ $clients ] unless ref $clients eq 'ARRAY';	62	$api_key = Koha::ApiKeys->find( $client_id );
63	my ($client) = grep { $_->{client_id} eq $client_id } @$clients;	63	}
64	return (0, 'unauthorized_client') unless $client;	64
		65	# client_id mandatory and exists on the DB
		66	return (0, 'unauthorized_client') unless $api_key && $api_key->active;
65		67
66	return (0, 'access_denied') unless $client_secret eq $client->{client_secret};	68	return (0, 'access_denied') unless $api_key->secret eq $client_secret;
67		69
68	return (1, undef, []);	70	return (1, undef, []);
69	}	71	}

Lines 26-35 use Net::OAuth2::AuthorizationServer; Link Here

(-)a/Koha/REST/V1/Auth.pm (-6 / +4 lines)
26	use C4::Auth qw( check_cookie_auth get_session haspermission );	26	use C4::Auth qw( check_cookie_auth get_session haspermission );
27	use C4::Context;	27	use C4::Context;
28		28
		29	use Koha::ApiKeys;
29	use Koha::Account::Lines;	30	use Koha::Account::Lines;
30	use Koha::Checkouts;	31	use Koha::Checkouts;
31	use Koha::Holds;	32	use Koha::Holds;
32	use Koha::OAuth;	33	use Koha::OAuth;
		34	use Koha::OAuthAccessTokens;
33	use Koha::Old::Checkouts;	35	use Koha::Old::Checkouts;
34	use Koha::Patrons;	36	use Koha::Patrons;
35		37
Lines 125-135 sub authenticate_api_request { Link Here
125	);	127	);
126		128
127	if ($valid_token) {	129	if ($valid_token) {
128	my $clients = C4::Context->config('api_client');	130	my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id;
129	$clients = [ $clients ] unless ref $clients eq 'ARRAY';	131	my $patron = Koha::Patrons->find($patron_id);
130	my ($client) = grep { $_->{client_id} eq $valid_token->{client_id} } @$clients;
131
132	my $patron = Koha::Patrons->find($client->{patron_id});
133	my $permissions = $authorization->{'permissions'};	132	my $permissions = $authorization->{'permissions'};
134	# Check if the patron is authorized	133	# Check if the patron is authorized
135	if ( haspermission($patron->userid, $permissions)	134	if ( haspermission($patron->userid, $permissions)
136	-