Attachment 114310 Details for Bug 27117 – Bug 27117: Only place_holds permission is needed to adjust pickup locations

[patch] Bug 27117: Only place_holds permission is needed to adjust pickup locations

Bug-27117-Only-placeholds-permission-is-needed-to-.patch (text/plain), 2.29 KB, created by Tomás Cohen Arazi (tcohen) on 2020-12-10 14:56:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2020-12-10 14:56:19 UTC

Size: 2.29 KB

patch

obsolete

>From a18e645519944a7c4d57f177ffbfe7818b97abd9 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 1 Dec 2020 11:44:04 +0100
>Subject: [PATCH] Bug 27117: Only place_holds permission is needed to adjust
> pickup locations
>
>The GET /pickup_locations route is requesting the whole reserveforothers
>permission whereas only the subpermission place_holds is needed.
>
>Test plan:
>0. Don't apply this patch
>1. Set the subpermission place_holds but modify_holds_priority
>2. Edit a hold and click the pickup library dropdown list
>3. You get a JS alert and log displays
>  GET /api/v1/app.pl/api/v1/holds/5/pickup_locations
>  403 Forbidden
>4. Apply this patch
>5. Reload the page, click the dropdown list, modify the pickup location
>and save
>=> Success!
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> api/v1/swagger/paths/holds.json |  2 +-
> t/db_dependent/api/v1/holds.t   | 12 +++++++++++-
> 2 files changed, 12 insertions(+), 2 deletions(-)
>
>diff --git a/api/v1/swagger/paths/holds.json b/api/v1/swagger/paths/holds.json
>index 3792985c8cb..386b4a94701 100644
>--- a/api/v1/swagger/paths/holds.json
>+++ b/api/v1/swagger/paths/holds.json
>@@ -672,7 +672,7 @@
>       },
>       "x-koha-authorization": {
>         "permissions": {
>-          "reserveforothers": "1"
>+          "reserveforothers": "place_holds"
>         }
>       }
>     }
>diff --git a/t/db_dependent/api/v1/holds.t b/t/db_dependent/api/v1/holds.t
>index 585e19a8a50..f9a4819d0cd 100755
>--- a/t/db_dependent/api/v1/holds.t
>+++ b/t/db_dependent/api/v1/holds.t
>@@ -686,11 +686,21 @@ subtest 'pickup_locations() tests' => sub {
>     my $patron = $builder->build_object(
>         {
>             class => 'Koha::Patrons',
>-            value => { userid => 'tomasito', flags => 1 }
>+            value => { userid => 'tomasito', flags => 0 }
>         }
>     );
>     $patron->set_password( { password => $password, skip_validation => 1 } );
>     my $userid = $patron->userid;
>+    $builder->build(
>+        {
>+            source => 'UserPermission',
>+            value  => {
>+                borrowernumber => $patron->borrowernumber,
>+                module_bit     => 6,
>+                code           => 'place_holds',
>+            },
>+        }
>+    );
> 
>     my $item_class = Test::MockModule->new('Koha::Item');
>     $item_class->mock(
>-- 
>2.29.2

Actions: View | Diff | Splinter Review

Attachments on bug 27117: 114060 | 114063 | 114064 | 114310 | 114451