Bugzilla – Attachment 52993 Details for
Bug 14868
REST API: Swagger2-driven permission checking
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 14868: Give users possibility to request their own object
SIGNED-OFF-Bug-14868-Give-users-possibility-to-req.patch (text/plain), 2.82 KB, created by
Johanna Räisä
on 2016-06-30 13:53:33 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 14868: Give users possibility to request their own object
Filename:
MIME Type:
Creator:
Johanna Räisä
Created:
2016-06-30 13:53:33 UTC
Size:
2.82 KB
patch
obsolete
>From 00ade4c161bd61c23f50790d720e6bf80ea1c5a8 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <larit@student.uef.fi> >Date: Fri, 17 Jun 2016 11:43:52 +0300 >Subject: [PATCH] [SIGNED-OFF] Bug 14868: Give users possibility to request > their own object >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >If the user has no required permissions, but attempts to access his own object, >allow this request in case "x-koha-permission" has defined "allow-owner": "1". > >As an example, the following resource can be accessed if user has borrowers-flag >or if he is making the request to his own borrowernumber (in path or body): > >"/patrons/{borrowernumber}": { > .. > "x-koha-permission": { > "allow-owner": "1", > "permissions": { > "borrowers": "1" > } > } >} > >Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> > >My name is Olli-Antti Kivilahti and I approve this commit. >We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now >in production and I am certain we have a pretty good idea on how to work with >the limitations of Swagger2.0 >We participated in the development of the Mojolicious::Plugin::Swagger and know >it well. We have made an extension to the plugin to provide full CORS support >and have been building all our in-house features on the new REST API. > >Signed-off-by: Johanna Raisa <johanna.raisa@gmail.com> > >My name is Johanna Räisä and I approve this commit. >We have been using Swagger2.0-driven REST API in production successfully. >--- > Koha/REST/V1.pm | 23 ++++++++++++++++++++++- > 1 file changed, 22 insertions(+), 1 deletion(-) > >diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm >index c3f3ab6..568cbd5 100644 >--- a/Koha/REST/V1.pm >+++ b/Koha/REST/V1.pm >@@ -105,7 +105,12 @@ sub authenticate_api_request { > } > > if ($action_spec->{'x-koha-permission'}) { >- if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { >+ if (_allowOwner($c, $action_spec, $user)) { >+ return $next->($c); >+ } >+ my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; >+ >+ if (C4::Auth::haspermission($user->userid, $permissions)) { > return $next->($c); > } > else { >@@ -121,4 +126,20 @@ sub authenticate_api_request { > } > } > >+sub _allowOwner { >+ my ($c, $action_spec, $user) = @_; >+ >+ my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; >+ >+ return unless $allowOwner && $allowOwner == 1; >+ if ($c->param("borrowernumber")) { >+ return $c->param("borrowernumber") >+ && $user->borrowernumber == $c->param("borrowernumber"); >+ } >+ elsif ($c->req->json && $c->req->json->{"borrowernumber"}) { >+ return $c->req->json->{"borrowernumber"} >+ && $user->borrowernumber == $c->req->json->{"borrowernumber"}; >+ } >+} >+ > 1; >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14868
:
42761
|
52577
|
52578
|
52579
|
52592
|
52593
|
52594
|
52602
|
52603
|
52604
|
52963
|
52964
|
52965
|
52966
|
52967
|
52981
|
52992
|
52993
|
52994
|
52995
|
52996
|
54457
|
54458
|
54459
|
54631
|
54632
|
54633
|
54765
|
54766
|
54767
|
54770
|
54771
|
54894
|
54895
|
54896
|
54897
|
55084
|
55085
|
55086
|
55087
|
55088
|
55089
|
55099
|
55100
|
55101
|
55102
|
55103
|
55104
|
55105