View | Details | Raw Unified | Return to bug 23634
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons.pm (-19 / +28 lines)
Lines 208-231 sub update { Link Here
208
        my $body = $c->validation->param('body');
208
        my $body = $c->validation->param('body');
209
        my $user = $c->stash('koha.user');
209
        my $user = $c->stash('koha.user');
210
210
211
        if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) {
211
        if (
212
            my $put_email     = $body->{email} // qw{};
212
                $patron->is_superlibrarian
213
            my $db_email      = $patron->email // qw{};
213
            and !$user->is_superlibrarian
214
            my $put_email_pro = $body->{secondary_email} // qw{};
214
            and (  exists $body->{email}
215
            my $db_email_pro  = $patron->emailpro // qw{};
215
                or exists $body->{secondary_email}
216
            my $put_email_B   = $body->{altaddress_email} // qw{};
216
                or exists $body->{altaddress_email} )
217
            my $db_email_B    = $patron->B_email // qw{};
217
          )
218
218
        {
219
            return $c->render(
219
            foreach my $email_field ( qw(email secondary_email altaddress_email) ) {
220
                status  => 403,
220
                my $exists_email = exists $body->{$email_field};
221
                openapi => {
221
                next unless $exists_email;
222
                    error =>
222
223
                      "Not enough privileges to change a superlibrarian's email"
223
                # exists, verify if we are asked to change it
224
                }
224
                my $put_email      = $body->{$email_field};
225
              )
225
                # As of writing this patch, 'email' is the only unmapped field
226
              if ($put_email ne $db_email)
226
                # (i.e. it preserves its name, hence this fallback)
227
              || ($put_email_pro ne $db_email_pro)
227
                my $db_email_field = $patron->to_api_mapping->{$email_field} // 'email';
228
              || ($put_email_B ne $db_email_B);
228
                my $db_email       = $patron->$db_email_field;
229
230
                return $c->render(
231
                    status  => 403,
232
                    openapi => { error => "Not enough privileges to change a superlibrarian's email" }
233
                  )
234
                  unless ( !defined $put_email and !defined $db_email )
235
                  or (  defined $put_email
236
                    and defined $db_email
237
                    and $put_email eq $db_email );
238
            }
229
        }
239
        }
230
240
231
        $patron->set_from_api($c->validation->param('body'))->store;
241
        $patron->set_from_api($c->validation->param('body'))->store;
232
- 

Return to bug 23634