Bugzilla – Attachment 155544 Details for
Bug 34287
Patron's should not be able to ask for checkoutability for different patrons
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34287: Add check on public availability endpoint
Bug-34287-Add-check-on-public-availability-endpoin.patch (text/plain), 1.04 KB, created by
Martin Renvoize (ashimema)
on 2023-09-12 09:26:45 UTC
(
hide
)
Description:
Bug 34287: Add check on public availability endpoint
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2023-09-12 09:26:45 UTC
Size:
1.04 KB
patch
obsolete
>From 242abeeedf26ce6d1226878a7ee8d9664d4d2749 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 12 Sep 2023 10:25:36 +0100 >Subject: [PATCH] Bug 34287: Add check on public availability endpoint > >A quick check for patron equals current user in the public availability >endpoint. >--- > Koha/REST/V1/Checkouts.pm | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm >index e94d027e49..d8f0827d6f 100644 >--- a/Koha/REST/V1/Checkouts.pm >+++ b/Koha/REST/V1/Checkouts.pm >@@ -156,6 +156,12 @@ sub get_availability { > my $user = $c->stash('koha.user'); > > my $patron = Koha::Patrons->find( $c->param('patron_id') ); >+ >+ if ( $c->stash('is_public') && ( $user->id ne $patron->id ) ) { >+ my $error = { error => 'Unauthorized', error_code => 'UNAUTHORIZED' }; >+ return $c->render( status => 403, openapi => $error ); >+ } >+ > my $item = Koha::Items->find( $c->param('item_id') ); > > my ( $impossible, $confirmation, $warnings ) = >-- >2.41.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34287
:
155544
|
155929
|
155930
|
158043
|
158044
|
158251
|
158252