Attachment 135946 Details for Bug 30780 – Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API

[patch] Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API

Bug-30780-Librarians-with-only-placeholds-permissi.patch (text/plain), 1.80 KB, created by Kyle M Hall (khall) on 2022-06-10 15:48:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall (khall)

Created: 2022-06-10 15:48:42 UTC

Size: 1.80 KB

patch

obsolete

>From 6894581aee600477259fa16a05c0dc386bcb76be Mon Sep 17 00:00:00 2001
>From: Johanna Raisa <johanna.raisa@gmail.com>
>Date: Tue, 17 May 2022 08:58:15 +0300
>Subject: [PATCH] Bug 30780: Librarians with only "place_holds" permissions can
> not update holds data via REST API
>
>This patch enables librarians with only "place_holds" permissions to cancel, suspend and resume holds via REST API.
>
>Test plan:
>1) Try to cancel or suspend a hold with only "place_holds" permissions
>2) See that it is forbidden.
>3) Apply the patch
>4) Cancel a hold again
>5) The cancellation succeeds
>6) prove t/db_dependent/api/v1/holds.t
>
>Sponsored-by: Koha-Suomi Oy
>
>Signed-off-by: David Nind <david@davidnind.com>
>
>Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
>---
> api/v1/swagger/paths/holds.yaml | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/api/v1/swagger/paths/holds.yaml b/api/v1/swagger/paths/holds.yaml
>index 9641b69435..617eb3d9d3 100644
>--- a/api/v1/swagger/paths/holds.yaml
>+++ b/api/v1/swagger/paths/holds.yaml
>@@ -401,7 +401,7 @@
>           $ref: "../swagger.yaml#/definitions/error"
>     x-koha-authorization:
>       permissions:
>-        reserveforothers: "1"
>+        reserveforothers: place_holds
> "/holds/{hold_id}/priority":
>   put:
>     x-mojo-to: Holds#update_priority
>@@ -511,7 +511,7 @@
>           $ref: "../swagger.yaml#/definitions/error"
>     x-koha-authorization:
>       permissions:
>-        reserveforothers: "1"
>+        reserveforothers: place_holds
>   delete:
>     x-mojo-to: Holds#resume
>     operationId: resumeHold
>@@ -556,7 +556,7 @@
>           $ref: "../swagger.yaml#/definitions/error"
>     x-koha-authorization:
>       permissions:
>-        reserveforothers: "1"
>+        reserveforothers: place_holds
> "/holds/{hold_id}/pickup_locations":
>   get:
>     x-mojo-to: Holds#pickup_locations
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 30780: 135052 | 135080 | 135946 | 136031 | 136032