Bugzilla – Attachment 110520 Details for
Bug 26322
REST API plugin authorization is not checked anymore
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26322: [19.11.x] Permissions not checked correctly for plugins
Bug-26322-1911x-Permissions-not-checked-correctly-.patch (text/plain), 1.80 KB, created by
Aleisha Amohia
on 2020-09-21 22:16:07 UTC
(
hide
)
Description:
Bug 26322: [19.11.x] Permissions not checked correctly for plugins
Filename:
MIME Type:
Creator:
Aleisha Amohia
Created:
2020-09-21 22:16:07 UTC
Size:
1.80 KB
patch
obsolete
>From f0ea0b6cee3dde6be3c433bab7441fa8bae30baa Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Mon, 31 Aug 2020 09:43:09 -0300 >Subject: [PATCH] Bug 26322: [19.11.x] Permissions not checked correctly for > plugins >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >This patch fixes the logic in a condition to address the fact that >permissions are not checked for plugins. This was due to bad parenthesis >pairing and the lack of good tests for this. > >To test: >1. Apply the regression tests patch >2. Run: > $ kshell > k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t >=> FAIL: Tests fail because of bad logic >3. Apply this patch >4. Repeat (2) >=> SUCCESS: Tests pass! >5. Verify the tests cover the use cases that are needed: > - Anonymous access > - Real user with wrong permissions (parameters => 1) > - Real user with right permissions (borrowers => 1) >=> SUCCESS: Needed use cases so we catch any regression are found >6. Sign off :-D > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > Koha/REST/V1/Auth.pm | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index ca26530f61..cec55a0274 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -254,7 +254,7 @@ sub authenticate_api_request { > if ( !$authorization and > ( $params->{is_public} and > ( C4::Context->preference('RESTPublicAnonymousRequests') or >- $user) ) or $params->{is_plugin} ) { >+ $user) or $params->{is_plugin} ) ) { > # We do not need any authorization > # Check the parameters > validate_query_parameters( $c, $spec ); >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26322
:
109358
|
109366
|
109367
|
109428
|
109429
|
109512
|
109513
|
109517
|
109518
|
109539
|
109540
|
110519
| 110520