Bugzilla – Attachment 184590 Details for
Bug 36561
Inappropriate permission for "/api/v1/auth/password/validation"
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36561: Add new permission `api_validate_password`
Bug-36561-Add-new-permission-apivalidatepassword.patch (text/plain), 3.91 KB, created by
Tomás Cohen Arazi (tcohen)
on 2025-07-24 12:36:05 UTC
(
hide
)
Description:
Bug 36561: Add new permission `api_validate_password`
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2025-07-24 12:36:05 UTC
Size:
3.91 KB
patch
obsolete
>From 54d2ab424c4ccf2849557c9e646128be8931f2f0 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 23 Jul 2025 18:23:16 -0300 >Subject: [PATCH] Bug 36561: Add new permission `api_validate_password` > >This change adds a `api_validate_password` permission which allows a user to only >validate borrowers by using the /api/v1/auth/password/validation endpoint. > >This avoids scenarios where you want third-parties to authenticate a user without >giving them full permissions to perform CRUD operations on user data. > >To test: >1. Apply patch >2. Run "koha-upgrade-schema kohadev" >3. koha-plack --reload kohadev >4. prove -v t/db_dependent/api/v1/password_validation.t >5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 >6. Note that a new subpermission `api_validate_password` appears under the "borrowers" permission > >Signed-off-by: David Nind <david@davidnind.com> >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > .../data/mysql/atomicupdate/bug_36561.pl | 20 +++++++++++++++++++ > .../data/mysql/mandatory/userpermissions.sql | 1 + > .../prog/en/includes/permissions.inc | 3 +++ > 3 files changed, 24 insertions(+) > create mode 100755 installer/data/mysql/atomicupdate/bug_36561.pl > >diff --git a/installer/data/mysql/atomicupdate/bug_36561.pl b/installer/data/mysql/atomicupdate/bug_36561.pl >new file mode 100755 >index 00000000000..87623d85544 >--- /dev/null >+++ b/installer/data/mysql/atomicupdate/bug_36561.pl >@@ -0,0 +1,20 @@ >+use Modern::Perl; >+use Koha::Installer::Output qw(say_warning say_success say_info); >+ >+return { >+ bug_number => "36561", >+ description => "Add new permission for validation passwords on the API", >+ up => sub { >+ my ($args) = @_; >+ my ( $dbh, $out ) = @$args{qw(dbh out)}; >+ >+ $dbh->do( >+ q{ >+ INSERT IGNORE INTO permissions (module_bit, code, description) >+ VALUES (4, 'api_validate_password', 'Validate patron passwords using the API') >+ } >+ ); >+ >+ say_success( $out, "Added new permission 'borrowers:api_validate_password'" ); >+ }, >+}; >diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql >index d5121c91fd2..1ff3f33d1e5 100644 >--- a/installer/data/mysql/mandatory/userpermissions.sql >+++ b/installer/data/mysql/mandatory/userpermissions.sql >@@ -44,6 +44,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES > ( 3, 'manage_search_filters', 'Manage custom search filters'), > ( 3, 'manage_identity_providers', 'Manage identity providers'), > ( 3, 'manage_record_sources', 'Manage record sources'), >+ ( 4, 'api_validate_password', 'Validate patron passwords using the API'), > ( 4, 'delete_borrowers', 'Delete patrons'), > ( 4, 'edit_borrowers', 'Add, modify and view patron information'), > ( 4, 'list_borrowers', 'Search, list and view patrons'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >index a0e17a2d418..9ee9543772d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >@@ -236,6 +236,9 @@ > View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. > </span> > <span class="permissioncode">([% name | html %])</span> >+ [%- CASE 'api_validate_password' -%] >+ <span class="sub_permission api_validate_password_subpermission">Validate patron passwords using the API</span> >+ <span class="permissioncode">([% name | html %])</span> > [%- CASE 'send_messages_to_borrowers' -%] > <span class="sub_permission send_messages_to_borrowers_subpermission"> Send messages to patrons </span> > <span class="permissioncode">([% name | html %])</span> >-- >2.50.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36561
:
165447
|
165713
|
165718
|
166545
|
166546
|
166547
|
166549
|
166550
|
166551
| 184590 |
184591
|
184630