View | Details | Raw Unified | Return to bug 24067
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-103 lines)
Lines 364-471 sub check_resource_ownership { Link Here
364
    return 0;
364
    return 0;
365
}
365
}
366
366
367
=head3 check_object_ownership
368
369
Determines ownership of an object from request parameters.
370
371
As introducing an endpoint that allows access for object's owner; if the
372
parameter that will be used to determine ownership is not already inside
373
$parameters, add a new subroutine that checks the ownership and extend
374
$parameters to contain a key with parameter_name and a value of a subref to
375
the subroutine that you created.
376
377
=cut
378
379
sub check_object_ownership {
380
    my ($c, $user) = @_;
381
382
    return if not $c or not $user;
383
384
    my $parameters = {
385
        accountlines_id => \&_object_ownership_by_accountlines_id,
386
        borrowernumber  => \&_object_ownership_by_patron_id,
387
        patron_id       => \&_object_ownership_by_patron_id,
388
        checkout_id     => \&_object_ownership_by_checkout_id,
389
        reserve_id      => \&_object_ownership_by_reserve_id,
390
    };
391
392
    foreach my $param ( keys %{ $parameters } ) {
393
        my $check_ownership = $parameters->{$param};
394
        if ($c->stash($param)) {
395
            return &$check_ownership($c, $user, $c->stash($param));
396
        }
397
        elsif ($c->param($param)) {
398
            return &$check_ownership($c, $user, $c->param($param));
399
        }
400
        elsif ($c->match->stack->[-1]->{$param}) {
401
            return &$check_ownership($c, $user, $c->match->stack->[-1]->{$param});
402
        }
403
        elsif ($c->req->json && $c->req->json->{$param}) {
404
            return 1 if &$check_ownership($c, $user, $c->req->json->{$param});
405
        }
406
    }
407
}
408
409
=head3 _object_ownership_by_accountlines_id
410
411
Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it
412
belongs to C<$user>.
413
414
=cut
415
416
sub _object_ownership_by_accountlines_id {
417
    my ($c, $user, $accountlines_id) = @_;
418
419
    my $accountline = Koha::Account::Lines->find($accountlines_id);
420
    return $accountline && $user->borrowernumber == $accountline->borrowernumber;
421
}
422
423
=head3 _object_ownership_by_borrowernumber
424
425
Compares C<$borrowernumber> to currently logged in C<$user>.
426
427
=cut
428
429
sub _object_ownership_by_patron_id {
430
    my ($c, $user, $patron_id) = @_;
431
432
    return $user->borrowernumber == $patron_id;
433
}
434
435
=head3 _object_ownership_by_checkout_id
436
437
First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one,
438
compare its borrowernumber to currently logged in C<$user>. However, if an issue
439
is not found, attempt to find a Koha::Old::Checkout-object instead and compare its
440
borrowernumber to currently logged in C<$user>.
441
442
=cut
443
444
sub _object_ownership_by_checkout_id {
445
    my ($c, $user, $issue_id) = @_;
446
447
    my $issue = Koha::Checkouts->find($issue_id);
448
    $issue = Koha::Old::Checkouts->find($issue_id) unless $issue;
449
    return $issue && $issue->borrowernumber
450
            && $user->borrowernumber == $issue->borrowernumber;
451
}
452
453
=head3 _object_ownership_by_reserve_id
454
455
Finds a Koha::Hold-object by C<$reserve_id> and checks if it
456
belongs to C<$user>.
457
458
TODO: Also compare against old_reserves
459
460
=cut
461
462
sub _object_ownership_by_reserve_id {
463
    my ($c, $user, $reserve_id) = @_;
464
465
    my $reserve = Koha::Holds->find($reserve_id);
466
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
467
}
468
469
=head3 _basic_auth
367
=head3 _basic_auth
470
368
471
Internal method that performs Basic authentication.
369
Internal method that performs Basic authentication.
472
- 

Return to bug 24067