Bugzilla – Attachment 95555 Details for
Bug 24067
Refactor REST API allow-owner authorization logic
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24067: Remove check_object_ownership and old authorization methods
Bug-24067-Remove-checkobjectownership-and-old-auth.patch (text/plain), 3.83 KB, created by
Lari Taskula
on 2019-11-19 14:36:59 UTC
(
hide
)
Description:
Bug 24067: Remove check_object_ownership and old authorization methods
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2019-11-19 14:36:59 UTC
Size:
3.83 KB
patch
obsolete
>From 8cb75af8663bf2bd5db5bc4784cb753ca3c58eb1 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Tue, 19 Nov 2019 13:58:22 +0000 >Subject: [PATCH] Bug 24067: Remove check_object_ownership and old > authorization methods > >Sponsored-by: Koha-Suomi Oy >--- > Koha/REST/V1/Auth.pm | 102 ------------------------------------------- > 1 file changed, 102 deletions(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 6e99c13359..c97c98749b 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -364,108 +364,6 @@ sub check_resource_ownership { > return 0; > } > >-=head3 check_object_ownership >- >-Determines ownership of an object from request parameters. >- >-As introducing an endpoint that allows access for object's owner; if the >-parameter that will be used to determine ownership is not already inside >-$parameters, add a new subroutine that checks the ownership and extend >-$parameters to contain a key with parameter_name and a value of a subref to >-the subroutine that you created. >- >-=cut >- >-sub check_object_ownership { >- my ($c, $user) = @_; >- >- return if not $c or not $user; >- >- my $parameters = { >- accountlines_id => \&_object_ownership_by_accountlines_id, >- borrowernumber => \&_object_ownership_by_patron_id, >- patron_id => \&_object_ownership_by_patron_id, >- checkout_id => \&_object_ownership_by_checkout_id, >- reserve_id => \&_object_ownership_by_reserve_id, >- }; >- >- foreach my $param ( keys %{ $parameters } ) { >- my $check_ownership = $parameters->{$param}; >- if ($c->stash($param)) { >- return &$check_ownership($c, $user, $c->stash($param)); >- } >- elsif ($c->param($param)) { >- return &$check_ownership($c, $user, $c->param($param)); >- } >- elsif ($c->match->stack->[-1]->{$param}) { >- return &$check_ownership($c, $user, $c->match->stack->[-1]->{$param}); >- } >- elsif ($c->req->json && $c->req->json->{$param}) { >- return 1 if &$check_ownership($c, $user, $c->req->json->{$param}); >- } >- } >-} >- >-=head3 _object_ownership_by_accountlines_id >- >-Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it >-belongs to C<$user>. >- >-=cut >- >-sub _object_ownership_by_accountlines_id { >- my ($c, $user, $accountlines_id) = @_; >- >- my $accountline = Koha::Account::Lines->find($accountlines_id); >- return $accountline && $user->borrowernumber == $accountline->borrowernumber; >-} >- >-=head3 _object_ownership_by_borrowernumber >- >-Compares C<$borrowernumber> to currently logged in C<$user>. >- >-=cut >- >-sub _object_ownership_by_patron_id { >- my ($c, $user, $patron_id) = @_; >- >- return $user->borrowernumber == $patron_id; >-} >- >-=head3 _object_ownership_by_checkout_id >- >-First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one, >-compare its borrowernumber to currently logged in C<$user>. However, if an issue >-is not found, attempt to find a Koha::Old::Checkout-object instead and compare its >-borrowernumber to currently logged in C<$user>. >- >-=cut >- >-sub _object_ownership_by_checkout_id { >- my ($c, $user, $issue_id) = @_; >- >- my $issue = Koha::Checkouts->find($issue_id); >- $issue = Koha::Old::Checkouts->find($issue_id) unless $issue; >- return $issue && $issue->borrowernumber >- && $user->borrowernumber == $issue->borrowernumber; >-} >- >-=head3 _object_ownership_by_reserve_id >- >-Finds a Koha::Hold-object by C<$reserve_id> and checks if it >-belongs to C<$user>. >- >-TODO: Also compare against old_reserves >- >-=cut >- >-sub _object_ownership_by_reserve_id { >- my ($c, $user, $reserve_id) = @_; >- >- my $reserve = Koha::Holds->find($reserve_id); >- return $reserve && $user->borrowernumber == $reserve->borrowernumber; >-} >- > =head3 _basic_auth > > Internal method that performs Basic authentication. >-- >2.17.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24067
:
95553
|
95554
| 95555 |
95556
|
95561
|
95571