Lines 364-471
sub check_resource_ownership {
Link Here
|
364 |
return 0; |
364 |
return 0; |
365 |
} |
365 |
} |
366 |
|
366 |
|
367 |
=head3 check_object_ownership |
|
|
368 |
|
369 |
Determines ownership of an object from request parameters. |
370 |
|
371 |
As introducing an endpoint that allows access for object's owner; if the |
372 |
parameter that will be used to determine ownership is not already inside |
373 |
$parameters, add a new subroutine that checks the ownership and extend |
374 |
$parameters to contain a key with parameter_name and a value of a subref to |
375 |
the subroutine that you created. |
376 |
|
377 |
=cut |
378 |
|
379 |
sub check_object_ownership { |
380 |
my ($c, $user) = @_; |
381 |
|
382 |
return if not $c or not $user; |
383 |
|
384 |
my $parameters = { |
385 |
accountlines_id => \&_object_ownership_by_accountlines_id, |
386 |
borrowernumber => \&_object_ownership_by_patron_id, |
387 |
patron_id => \&_object_ownership_by_patron_id, |
388 |
checkout_id => \&_object_ownership_by_checkout_id, |
389 |
reserve_id => \&_object_ownership_by_reserve_id, |
390 |
}; |
391 |
|
392 |
foreach my $param ( keys %{ $parameters } ) { |
393 |
my $check_ownership = $parameters->{$param}; |
394 |
if ($c->stash($param)) { |
395 |
return &$check_ownership($c, $user, $c->stash($param)); |
396 |
} |
397 |
elsif ($c->param($param)) { |
398 |
return &$check_ownership($c, $user, $c->param($param)); |
399 |
} |
400 |
elsif ($c->match->stack->[-1]->{$param}) { |
401 |
return &$check_ownership($c, $user, $c->match->stack->[-1]->{$param}); |
402 |
} |
403 |
elsif ($c->req->json && $c->req->json->{$param}) { |
404 |
return 1 if &$check_ownership($c, $user, $c->req->json->{$param}); |
405 |
} |
406 |
} |
407 |
} |
408 |
|
409 |
=head3 _object_ownership_by_accountlines_id |
410 |
|
411 |
Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it |
412 |
belongs to C<$user>. |
413 |
|
414 |
=cut |
415 |
|
416 |
sub _object_ownership_by_accountlines_id { |
417 |
my ($c, $user, $accountlines_id) = @_; |
418 |
|
419 |
my $accountline = Koha::Account::Lines->find($accountlines_id); |
420 |
return $accountline && $user->borrowernumber == $accountline->borrowernumber; |
421 |
} |
422 |
|
423 |
=head3 _object_ownership_by_borrowernumber |
424 |
|
425 |
Compares C<$borrowernumber> to currently logged in C<$user>. |
426 |
|
427 |
=cut |
428 |
|
429 |
sub _object_ownership_by_patron_id { |
430 |
my ($c, $user, $patron_id) = @_; |
431 |
|
432 |
return $user->borrowernumber == $patron_id; |
433 |
} |
434 |
|
435 |
=head3 _object_ownership_by_checkout_id |
436 |
|
437 |
First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one, |
438 |
compare its borrowernumber to currently logged in C<$user>. However, if an issue |
439 |
is not found, attempt to find a Koha::Old::Checkout-object instead and compare its |
440 |
borrowernumber to currently logged in C<$user>. |
441 |
|
442 |
=cut |
443 |
|
444 |
sub _object_ownership_by_checkout_id { |
445 |
my ($c, $user, $issue_id) = @_; |
446 |
|
447 |
my $issue = Koha::Checkouts->find($issue_id); |
448 |
$issue = Koha::Old::Checkouts->find($issue_id) unless $issue; |
449 |
return $issue && $issue->borrowernumber |
450 |
&& $user->borrowernumber == $issue->borrowernumber; |
451 |
} |
452 |
|
453 |
=head3 _object_ownership_by_reserve_id |
454 |
|
455 |
Finds a Koha::Hold-object by C<$reserve_id> and checks if it |
456 |
belongs to C<$user>. |
457 |
|
458 |
TODO: Also compare against old_reserves |
459 |
|
460 |
=cut |
461 |
|
462 |
sub _object_ownership_by_reserve_id { |
463 |
my ($c, $user, $reserve_id) = @_; |
464 |
|
465 |
my $reserve = Koha::Holds->find($reserve_id); |
466 |
return $reserve && $user->borrowernumber == $reserve->borrowernumber; |
467 |
} |
468 |
|
469 |
=head3 _basic_auth |
367 |
=head3 _basic_auth |
470 |
|
368 |
|
471 |
Internal method that performs Basic authentication. |
369 |
Internal method that performs Basic authentication. |
472 |
- |
|
|