Attachment 84507 Details for Bug 22227 – Bug 22227: Make GET /cities staff only

[patch] Bug 22227: Make GET /cities staff only

Bug-22227-Make-GET-cities-staff-only.patch (text/plain), 2.38 KB, created by Tomás Cohen Arazi (tcohen) on 2019-01-29 14:41:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2019-01-29 14:41:44 UTC

Size: 2.38 KB

patch

obsolete

>From 871ba32a1334edd20819f5d525fdd7f7c0a0a321 Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Tue, 29 Jan 2019 11:29:06 -0300
>Subject: [PATCH] Bug 22227: Make GET /cities staff only
>
>This patch removes the possibility to access the city objects without
>privileged access (minimum permissions == catalogue).
>
>It does so by adding the required permissions to the spec. The tests are
>adjusted.
>
>To test:
>- Apply this patch
>- Run:
>  $ kshell
> k$ prove t/db_dependent/api/v1/cities.t
>=> SUCCESS: Tests pass!
>- Sign off :-D
>---
> api/v1/swagger/paths/cities.json | 10 ++++++++++
> t/db_dependent/api/v1/cities.t   |  5 ++---
> 2 files changed, 12 insertions(+), 3 deletions(-)
>
>diff --git a/api/v1/swagger/paths/cities.json b/api/v1/swagger/paths/cities.json
>index 96bbe55d28..5779a48651 100644
>--- a/api/v1/swagger/paths/cities.json
>+++ b/api/v1/swagger/paths/cities.json
>@@ -60,6 +60,11 @@
>             "$ref": "../definitions.json#/error"
>           }
>         }
>+      },
>+      "x-koha-authorization": {
>+        "permissions": {
>+            "catalogue": "1"
>+        }
>       }
>     },
>     "post": {
>@@ -153,6 +158,11 @@
>             "$ref": "../definitions.json#/error"
>           }
>         }
>+      },
>+      "x-koha-authorization": {
>+        "permissions": {
>+            "catalogue": "1"
>+        }
>       }
>     },
>     "put": {
>diff --git a/t/db_dependent/api/v1/cities.t b/t/db_dependent/api/v1/cities.t
>index 765fdb71ad..ba64c29420 100644
>--- a/t/db_dependent/api/v1/cities.t
>+++ b/t/db_dependent/api/v1/cities.t
>@@ -45,8 +45,7 @@ subtest 'list() tests' => sub {
>     $schema->storage->txn_begin;
> 
>     Koha::Cities->search->delete;
>-    my ( $borrowernumber, $session_id ) =
>-      create_user_and_session( { authorized => 0 } );
>+    my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 });
> 
>     ## Authorized user tests
>     # No cities, so empty array should be returned
>@@ -116,7 +115,7 @@ subtest 'get() tests' => sub {
>     $schema->storage->txn_begin;
> 
>     my $city = $builder->build_object({ class => 'Koha::Cities' });
>-    my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 0 });
>+    my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 });
> 
>     my $tx = $t->ua->build_tx( GET => "/api/v1/cities/" . $city->id );
>     $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 22227: 84507 | 85060