Bugzilla – Attachment 64379 Details for
Bug 17424
System preference to control access to own objects without permission
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17424: [QA Follow-up] Tiny tidy
Bug-17424-QA-Follow-up-Tiny-tidy.patch (text/plain), 2.30 KB, created by
Marcel de Rooy
on 2017-06-16 09:24:11 UTC
(
hide
)
Description:
Bug 17424: [QA Follow-up] Tiny tidy
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2017-06-16 09:24:11 UTC
Size:
2.30 KB
patch
obsolete
>From 8ce2ac454e322484c2bf43bd4e632ed940fa3abf Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Fri, 16 Jun 2017 11:18:18 +0200 >Subject: [PATCH] Bug 17424: [QA Follow-up] Tiny tidy >Content-Type: text/plain; charset=utf-8 > >The tests for $authorization keys allow_owner or allow_guarantor are >in the subroutines already. Moving the owner_guarantor test result in >a variable. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > Koha/REST/V1.pm | 28 +++++++++++++--------------- > 1 file changed, 13 insertions(+), 15 deletions(-) > >diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm >index eb8d265..6585d25 100644 >--- a/Koha/REST/V1.pm >+++ b/Koha/REST/V1.pm >@@ -111,21 +111,19 @@ sub authenticate_api_request { > > # Check if the user is authorized > return $next->($c) if C4::Auth::haspermission($user->userid, $permissions); >- if (C4::Context->preference("AccessOwnObjectsInAPI")) { >- return $next->($c) if allow_owner($c, $authorization, $user); >- return $next->($c) if allow_guarantor($c, $authorization, $user); >- } else { >- if ($authorization->{'allow-owner'} && allow_owner($c, $authorization, >- $user) || $authorization->{'allow-guarantor'} && allow_guarantor( >- $c, $authorization, $user)) { >- return $c->render_swagger( >- { error => "Functionality for accessing own objects has been " >- ."disabled. Permission(s) required to access.", >- required_permissions => $permissions }, >- {}, >- 403 >- ); >- } >+ my $owner_or_guarantor = allow_owner($c, $authorization, $user) || >+ allow_guarantor($c, $authorization, $user); >+ if( C4::Context->preference("AccessOwnObjectsInAPI") ) { >+ return $next->($c) if $owner_or_guarantor; >+ } elsif( $owner_or_guarantor ) { >+ # Provide a slightly more specific error message >+ return $c->render_swagger( >+ { error => "Functionality for accessing own objects has been " >+ ."disabled. Permission(s) required to access.", >+ required_permissions => $permissions }, >+ {}, >+ 403 >+ ); > } > return $c->render_swagger( > { error => "Authorization failure. Missing required permission(s).", >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17424
:
56257
|
59099
|
64378
| 64379