Bugzilla – Attachment 165713 Details for
Bug 36561
Inappropriate permission for "/api/v1/auth/password/validation"
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation
Bug-36561-Add-validateborrowers-permission-for-api.patch (text/plain), 5.27 KB, created by
David Cook
on 2024-04-29 00:38:30 UTC
(
hide
)
Description:
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation
Filename:
MIME Type:
Creator:
David Cook
Created:
2024-04-29 00:38:30 UTC
Size:
5.27 KB
patch
obsolete
>From 455d5e0c3eb726c286498c66c031fe2b5a5d614a Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 24 Apr 2024 06:13:22 +0000 >Subject: [PATCH] Bug 36561: Add "validate_borrowers" permission for > /api/v1/auth/password/validation > >This change adds a "validate_borrowers" permission which allows a user to only >validate borrowers by using the /api/v1/auth/password/validation endpoint. > >This avoids scenarios where you want third-parties to authenticate a user without >giving them full permissions to perform CRUD operations on user data. > >To test: >1. Apply patch >2. Run "koha-upgrade-schema kohadev" >3. koha-plack --reload kohadev >4. prove -v t/db_dependent/api/v1/password_validation.t >5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 >6. Note that a new subpermission "validate_borrowers" appears under the >"borrowers" permission >--- > api/v1/swagger/paths/auth.yaml | 3 ++- > ...6561_add-new-validate-borrowers-permission.pl | 16 ++++++++++++++++ > .../data/mysql/mandatory/userpermissions.sql | 1 + > .../prog/en/includes/permissions.inc | 5 +++++ > t/db_dependent/api/v1/password_validation.t | 15 ++++++++++++++- > 5 files changed, 38 insertions(+), 2 deletions(-) > create mode 100644 installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl > >diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml >index b9dee70cdca..5d29f194c53 100644 >--- a/api/v1/swagger/paths/auth.yaml >+++ b/api/v1/swagger/paths/auth.yaml >@@ -1131,4 +1131,5 @@ > $ref: ../swagger.yaml#/definitions/error > x-koha-authorization: > permissions: >- borrowers: "1" >+ - borrowers: "validate_borrowers" >+ >diff --git a/installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl b/installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl >new file mode 100644 >index 00000000000..fa3b484d625 >--- /dev/null >+++ b/installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl >@@ -0,0 +1,16 @@ >+use Modern::Perl; >+ >+return { >+ bug_number => "BUG_36561", >+ description => "Add new validate_borrowers permission", >+ up => sub { >+ my ($args) = @_; >+ my ( $dbh, $out ) = @$args{qw(dbh out)}; >+ >+ $dbh->do( >+ "INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (4, 'validate_borrowers', 'Check validity of username and password')" >+ ); >+ >+ say $out "Added new permission 'validate_borrowers'"; >+ }, >+}; >diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql >index a132b83e204..13b77707f4e 100644 >--- a/installer/data/mysql/mandatory/userpermissions.sql >+++ b/installer/data/mysql/mandatory/userpermissions.sql >@@ -47,6 +47,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES > ( 4, 'delete_borrowers', 'Delete patrons'), > ( 4, 'edit_borrowers', 'Add, modify and view patron information'), > ( 4, 'list_borrowers', 'Search, list and view patrons'), >+ ( 4, 'validate_borrowers', 'Check validity of username and password'), > ( 4, 'view_borrower_infos_from_any_libraries', 'View patron infos from any libraries'), > ( 6, 'place_holds', 'Place holds for patrons'), > ( 6, 'modify_holds_priority', 'Modify holds priority'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >index 64accc2e859..4d4cb91dc3b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >@@ -317,6 +317,11 @@ > Search, list and view patrons > </span> > <span class="permissioncode">([% name | html %])</span> >+ [%- CASE 'validate_borrowers' -%] >+ <span class="sub_permission validate_borrowers_subpermission"> >+ Check validity of username and password >+ </span> >+ <span class="permissioncode">([% name | html %])</span> > [%- CASE 'view_borrower_infos_from_any_libraries' -%] > <span class="sub_permission view_borrower_infos_from_any_libraries_subpermission"> > View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. >diff --git a/t/db_dependent/api/v1/password_validation.t b/t/db_dependent/api/v1/password_validation.t >index 10527bc93d0..772895f6672 100755 >--- a/t/db_dependent/api/v1/password_validation.t >+++ b/t/db_dependent/api/v1/password_validation.t >@@ -39,9 +39,22 @@ $schema->storage->txn_begin; > my $librarian = $builder->build_object( > { > class => 'Koha::Patrons', >- value => { flags => 2 ** 4 } # borrowers flag = 4 >+ value => { flags => 0 } #No top-level permissions > } > ); >+ >+# Ensure our librarian can see users from all branches (once list_borrowers is added) >+$builder->build( >+ { >+ source => 'UserPermission', >+ value => { >+ borrowernumber => $librarian->borrowernumber, >+ module_bit => 4, >+ code => 'validate_borrowers', >+ }, >+ } >+); >+ > my $password = 'thePassword123'; > $librarian->set_password( { password => $password, skip_validation => 1 } ); > my $userid = $librarian->userid; >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36561
:
165447
|
165713
|
165718
|
166545
|
166546
|
166547
|
166549
|
166550
|
166551