Bugzilla – Attachment 95554 Details for
Bug 24067
Refactor REST API allow-owner authorization logic
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24067: Use check_resource_ownership in authorization
Bug-24067-Use-checkresourceownership-in-authorizat.patch (text/plain), 2.12 KB, created by
Lari Taskula
on 2019-11-19 14:36:48 UTC
(
hide
)
Description:
Bug 24067: Use check_resource_ownership in authorization
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2019-11-19 14:36:48 UTC
Size:
2.12 KB
patch
obsolete
>From 636f04fae95ce4e1c7f05b0c0bc1ff7965679ca2 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Tue, 19 Nov 2019 13:57:51 +0000 >Subject: [PATCH] Bug 24067: Use check_resource_ownership in authorization > >To test: >1. prove t/db_dependent/api/v1/patrons_password.t >2. Observe failure (yes, really a failure - tests will pass in later test) > >Looks like you failed 7 tests of 15. >t/db_dependent/api/v1/patrons_password.t .. 2/2 > Failed test 'set_public() (unprivileged user tests)' > at t/db_dependent/api/v1/patrons_password.t line 235. > Looks like you failed 1 test of 2. >t/db_dependent/api/v1/patrons_password.t .. Dubious, test returned 1 (wstat 256, 0x100) >Failed 1/2 subtests > >Sponsored-by: Koha-Suomi Oy >--- > Koha/REST/V1/Auth.pm | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index ef4a6ed9e6..6e99c13359 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -278,9 +278,9 @@ sub validate_query_parameters { > > =head3 allow_owner > >-Allows access to object for its owner. >+Allows access to resource for its owner. > >-There are endpoints that should allow access for the object owner even if they >+There are endpoints that should allow access for the resource owner even if they > do not have the required permission, e.g. access an own reserve. This can be > achieved by defining the operation as follows: > >@@ -303,12 +303,12 @@ sub allow_owner { > > return unless $authorization->{'allow-owner'}; > >- return check_object_ownership($c, $user) if $user and $c; >+ return check_resource_ownership($c, $user) if $user and $c; > } > > =head3 allow_guarantor > >-Same as "allow_owner", but checks if the object is owned by one of C<$user>'s >+Same as "allow_owner", but checks if the resource is owned by one of C<$user>'s > guarantees. > > =cut >@@ -322,7 +322,7 @@ sub allow_guarantor { > > my $guarantees = $user->guarantee_relationships->guarantees->as_list; > foreach my $guarantee (@{$guarantees}) { >- return 1 if check_object_ownership($c, $guarantee); >+ return 1 if check_resource_ownership($c, $guarantee); > } > } > >-- >2.17.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24067
:
95553
| 95554 |
95555
|
95556
|
95561
|
95571