View | Details | Raw Unified | Return to bug 24067
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-6 / +5 lines)
Lines 278-286 sub validate_query_parameters { Link Here
278
278
279
=head3 allow_owner
279
=head3 allow_owner
280
280
281
Allows access to object for its owner.
281
Allows access to resource for its owner.
282
282
283
There are endpoints that should allow access for the object owner even if they
283
There are endpoints that should allow access for the resource owner even if they
284
do not have the required permission, e.g. access an own reserve. This can be
284
do not have the required permission, e.g. access an own reserve. This can be
285
achieved by defining the operation as follows:
285
achieved by defining the operation as follows:
286
286
Lines 303-314 sub allow_owner { Link Here
303
303
304
    return unless $authorization->{'allow-owner'};
304
    return unless $authorization->{'allow-owner'};
305
305
306
    return check_object_ownership($c, $user) if $user and $c;
306
    return check_resource_ownership($c, $user) if $user and $c;
307
}
307
}
308
308
309
=head3 allow_guarantor
309
=head3 allow_guarantor
310
310
311
Same as "allow_owner", but checks if the object is owned by one of C<$user>'s
311
Same as "allow_owner", but checks if the resource is owned by one of C<$user>'s
312
guarantees.
312
guarantees.
313
313
314
=cut
314
=cut
Lines 322-328 sub allow_guarantor { Link Here
322
322
323
    my $guarantees = $user->guarantee_relationships->guarantees->as_list;
323
    my $guarantees = $user->guarantee_relationships->guarantees->as_list;
324
    foreach my $guarantee (@{$guarantees}) {
324
    foreach my $guarantee (@{$guarantees}) {
325
        return 1 if check_object_ownership($c, $guarantee);
325
        return 1 if check_resource_ownership($c, $guarantee);
326
    }
326
    }
327
}
327
}
328
328
329
- 

Return to bug 24067