Bugzilla – Attachment 52603 Details for
Bug 14868
REST API: Swagger2-driven permission checking
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14868: Give users possibility to request their own object
Bug-14868-Give-users-possibility-to-request-their-.patch (text/plain), 2.01 KB, created by
Lari Taskula
on 2016-06-20 15:19:18 UTC
(
hide
)
Description:
Bug 14868: Give users possibility to request their own object
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2016-06-20 15:19:18 UTC
Size:
2.01 KB
patch
obsolete
>From 815668d0e0b9eea58bbe4b78e54aee03b4fb0712 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <larit@student.uef.fi> >Date: Fri, 17 Jun 2016 11:43:52 +0300 >Subject: [PATCH] Bug 14868: Give users possibility to request their own object > >If the user has no required permissions, but attempts to access his own object, >allow this request in case "x-koha-permission" has defined "allow-owner": "1". > >As an example, the following resource can be accessed if user has borrowers-flag >or if he is making the request to his own borrowernumber (in path or body): > >"/patrons/{borrowernumber}": { > .. > "x-koha-permission": { > "allow-owner": "1", > "permissions": { > "borrowers": "1" > } > } >} >--- > Koha/REST/V1.pm | 23 ++++++++++++++++++++++- > 1 file changed, 22 insertions(+), 1 deletion(-) > >diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm >index 7fd53d3..5dccbed 100644 >--- a/Koha/REST/V1.pm >+++ b/Koha/REST/V1.pm >@@ -106,7 +106,12 @@ sub authenticate_api_request { > } > > if ($action_spec->{'x-koha-permission'}) { >- if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { >+ if (_allowOwner($c, $action_spec, $user)) { >+ return $next->($c); >+ } >+ my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; >+ >+ if (C4::Auth::haspermission($user->userid, $permissions)) { > return $next->($c); > } > else { >@@ -122,4 +127,20 @@ sub authenticate_api_request { > } > } > >+sub _allowOwner { >+ my ($c, $action_spec, $user) = @_; >+ >+ my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; >+ >+ return unless $allowOwner && $allowOwner == 1; >+ if ($c->param("borrowernumber")) { >+ return $c->param("borrowernumber") >+ && $user->borrowernumber == $c->param("borrowernumber"); >+ } >+ elsif ($c->req->json && $c->req->json->{"borrowernumber"}) { >+ return $c->req->json->{"borrowernumber"} >+ && $user->borrowernumber == $c->req->json->{"borrowernumber"}; >+ } >+} >+ > 1; >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14868
:
42761
|
52577
|
52578
|
52579
|
52592
|
52593
|
52594
|
52602
|
52603
|
52604
|
52963
|
52964
|
52965
|
52966
|
52967
|
52981
|
52992
|
52993
|
52994
|
52995
|
52996
|
54457
|
54458
|
54459
|
54631
|
54632
|
54633
|
54765
|
54766
|
54767
|
54770
|
54771
|
54894
|
54895
|
54896
|
54897
|
55084
|
55085
|
55086
|
55087
|
55088
|
55089
|
55099
|
55100
|
55101
|
55102
|
55103
|
55104
|
55105