Bugzilla – Attachment 146512 Details for
Bug 32502
Getting patrons/{patron_id} via REST API requires edit_borrowers permission
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 32502: Api call to patrons/{patron_id} permission change
Bug-32502-Api-call-to-patronspatronid-permission-c.patch (text/plain), 1.48 KB, created by
Kyle M Hall (khall)
on 2023-02-10 19:13:45 UTC
(
hide
)
Description:
Bug 32502: Api call to patrons/{patron_id} permission change
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2023-02-10 19:13:45 UTC
Size:
1.48 KB
patch
obsolete
>From 159c6eeb117234054df070b0bd2d025f5c6e7ee5 Mon Sep 17 00:00:00 2001 >From: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> >Date: Wed, 21 Dec 2022 16:56:01 +0000 >Subject: [PATCH] Bug 32502: Api call to patrons/{patron_id} permission change >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >The API permissions for GET patrons/{patron_id} required staff to have >edit_borrowers permission rather than >view_borrower_infos_from_any_libraries. This has now been changed to >allow staff to access patrons through the API. > >Test plan: >1) From a staff account that does not have edit_borrowers permission, > make a request to patrons/{patron_id} >2) The request should be rejected >3) Apply patch >4) Repeat the request >5) The request should return the data for the patron requested > >Signed-off-by: Frédéric Demians <f.demians@tamil.fr> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > api/v1/swagger/paths/patrons.yaml | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/api/v1/swagger/paths/patrons.yaml b/api/v1/swagger/paths/patrons.yaml >index 1100a9fba9..01a8a89a87 100644 >--- a/api/v1/swagger/paths/patrons.yaml >+++ b/api/v1/swagger/paths/patrons.yaml >@@ -501,7 +501,7 @@ > $ref: "../swagger.yaml#/definitions/error" > x-koha-authorization: > permissions: >- borrowers: edit_borrowers >+ borrowers: view_borrower_infos_from_any_libraries > put: > x-mojo-to: Patrons#update > operationId: updatePatron >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 32502
:
144783
|
144845
| 146512