Bugzilla – Attachment 158044 Details for
Bug 34287
Patron's should not be able to ask for checkoutability for different patrons
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34287: Add check on public availability endpoint
Bug-34287-Add-check-on-public-availability-endpoin.patch (text/plain), 1.66 KB, created by
Katrin Fischer
on 2023-10-29 14:45:44 UTC
(
hide
)
Description:
Bug 34287: Add check on public availability endpoint
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2023-10-29 14:45:44 UTC
Size:
1.66 KB
patch
obsolete
>From d58e6515128a65b3f9a6fd05aaaeb2b2b331d780 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 12 Sep 2023 10:25:36 +0100 >Subject: [PATCH] Bug 34287: Add check on public availability endpoint > >A quick check for patron equals current user in the public availability >endpoint. > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > api/v1/swagger/paths/checkouts.yaml | 2 ++ > t/db_dependent/api/v1/checkouts.t | 5 ++--- > 2 files changed, 4 insertions(+), 3 deletions(-) > >diff --git a/api/v1/swagger/paths/checkouts.yaml b/api/v1/swagger/paths/checkouts.yaml >index cd07123aff..f38c1e25e6 100644 >--- a/api/v1/swagger/paths/checkouts.yaml >+++ b/api/v1/swagger/paths/checkouts.yaml >@@ -411,3 +411,5 @@ > description: Under maintenance > schema: > $ref: "../swagger.yaml#/definitions/error" >+ x-koha-authorization: >+ allow-owner: true >diff --git a/t/db_dependent/api/v1/checkouts.t b/t/db_dependent/api/v1/checkouts.t >index d97c9a9ae6..8c16f1f88e 100755 >--- a/t/db_dependent/api/v1/checkouts.t >+++ b/t/db_dependent/api/v1/checkouts.t >@@ -342,9 +342,8 @@ subtest 'get_availability' => sub { > $t->get_ok("/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")->status_is(401); > > # Only allow availability lookup for self >- $t->get_ok( >- "//$userid:$password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id" >- )->status_is(403); >+ $t->get_ok("//$userid:$password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id") >+ ->status_is(403); > > # All ok > $t->get_ok( >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34287
:
155544
|
155929
|
155930
|
158043
|
158044
|
158251
|
158252