Bugzilla – Attachment 83614 Details for
Bug 22061
Add route to change patron's password (public)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22061: Add a /public namespace that can be switched on/off
Bug-22061-Add-a-public-namespace-that-can-be-switc.patch (text/plain), 3.41 KB, created by
Tomás Cohen Arazi (tcohen)
on 2019-01-03 12:10:03 UTC
(
hide
)
Description:
Bug 22061: Add a /public namespace that can be switched on/off
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2019-01-03 12:10:03 UTC
Size:
3.41 KB
patch
obsolete
>From 90efa0f404e916a8c5ed08d14fec5f1bbfaa31e6 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Wed, 2 Jan 2019 15:05:47 -0300 >Subject: [PATCH] Bug 22061: Add a /public namespace that can be switched > on/off > >This patch adds a check in Koha::REST::V1::Auth::under to catch all >routes that begin with 'public' (inside /api/v1). If they match, and the >RESTPublicAPI syspref is off, then an exception is thrown, rendering a >403 error to the consumer. > >Otherwise the routes are processed as usual. This is THE on/off switch >for the public REST API. The target use case: people not wanting an OPAC >or public interaction with the API besides privileged users. > >In order to test, the rest of the patches are needed because the only >way to test a route is having it in the spec. > >To test: >- Apply the patches >- Run: > $ kshell > k$ prove t/db_dependent/api/v1/auth.t >=> SUCCESS: tests pass! >- Sign off :-D >--- > Koha/REST/V1/Auth.pm | 14 ++++++++++++++ > t/db_dependent/api/v1/auth.t | 17 ++++++++++++++++- > 2 files changed, 30 insertions(+), 1 deletion(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index afbe468288..6b3c8d1ea5 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -57,8 +57,19 @@ sub under { > my $c = shift->openapi->valid_input or return;; > > my $status = 0; >+ > try { > >+ # /api/v1/{namespace} >+ my $namespace = $c->req->url->to_abs->path->[2]; >+ >+ if ( $namespace eq 'public' >+ and !C4::Context->preference('RESTPublicAPI') ) >+ { >+ Koha::Exceptions::Authorization->throw( >+ "Configuration prevents the usage of this endpoint by unprivileged users"); >+ } >+ > $status = authenticate_api_request($c); > > } catch { >@@ -89,6 +100,9 @@ sub under { > required_permissions => $_->required_permissions, > }); > } >+ elsif ($_->isa('Koha::Exceptions::Authorization')) { >+ return $c->render(status => 403, json => { error => $_->error }); >+ } > elsif ($_->isa('Koha::Exceptions')) { > return $c->render(status => 500, json => { error => $_->error }); > } >diff --git a/t/db_dependent/api/v1/auth.t b/t/db_dependent/api/v1/auth.t >index 447028c060..4f47227886 100644 >--- a/t/db_dependent/api/v1/auth.t >+++ b/t/db_dependent/api/v1/auth.t >@@ -39,12 +39,27 @@ my $t = Test::Mojo->new('Koha::REST::V1'); > my $tx; > > subtest 'under() tests' => sub { >- plan tests => 15; >+ >+ plan tests => 20; > > $schema->storage->txn_begin; > > my ($borrowernumber, $session_id) = create_user_and_session(); > >+ # disable the /public namespace >+ t::lib::Mocks::mock_preference( 'RESTPublicAPI', 0 ); >+ $tx = $t->ua->build_tx( POST => "/api/v1/public/patrons/$borrowernumber/password" ); >+ $tx->req->env( { REMOTE_ADDR => $remote_address } ); >+ $t->request_ok($tx) >+ ->status_is(403) >+ ->json_is('/error', 'Configuration prevents the usage of this endpoint by unprivileged users'); >+ >+ # enable the /public namespace >+ t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 ); >+ $tx = $t->ua->build_tx( GET => "/api/v1/public/patrons/$borrowernumber/password" ); >+ $tx->req->env( { REMOTE_ADDR => $remote_address } ); >+ $t->request_ok($tx)->status_is(404); >+ > # 401 (no authentication) > $tx = $t->ua->build_tx( GET => "/api/v1/patrons" ); > $tx->req->env( { REMOTE_ADDR => $remote_address } ); >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22061
:
83613
|
83614
|
83680
|
83681
|
83682
|
83755
|
83756
|
83764
|
83765
|
83766
|
83767
|
83768
|
84207
|
84288
|
84289
|
84290
|
84291
|
84292
|
84293
|
84294
|
84489