View | Details | Raw Unified | Return to bug 23634
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons.pm (+9 lines)
Lines 205-210 sub update { Link Here
205
     }
205
     }
206
206
207
    return try {
207
    return try {
208
        my $body = $c->validation->param('body');
209
        my $user = $c->stash('koha.user');
210
211
        if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) {
212
            return $c->render(
213
                status  => 403,
214
                openapi => { error => "Not enough privileges to change a superlibrarian's email" }
215
            ) if $body->{email} ne $patron->email ;
216
        }
208
217
209
        $patron->set_from_api($c->validation->param('body'))->store;
218
        $patron->set_from_api($c->validation->param('body'))->store;
210
        $patron->discard_changes;
219
        $patron->discard_changes;
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +18 lines)
Lines 222-235 subtest 'update() tests' => sub { Link Here
222
    $schema->storage->txn_rollback;
222
    $schema->storage->txn_rollback;
223
223
224
    subtest 'librarian access tests' => sub {
224
    subtest 'librarian access tests' => sub {
225
        plan tests => 22;
225
        plan tests => 25;
226
226
227
        $schema->storage->txn_begin;
227
        $schema->storage->txn_begin;
228
228
229
        my $authorized_patron = $builder->build_object(
229
        my $authorized_patron = $builder->build_object(
230
            {
230
            {
231
                class => 'Koha::Patrons',
231
                class => 'Koha::Patrons',
232
                value => { flags => 2**4 } # borrowers flag = 4
232
                value => { flags => 1 }
233
            }
233
            }
234
        );
234
        );
235
        my $password = 'thePassword123';
235
        my $password = 'thePassword123';
Lines 330-335 subtest 'update() tests' => sub { Link Here
330
        is(Koha::Patrons->find( $patron_2->id )->cardnumber,
330
        is(Koha::Patrons->find( $patron_2->id )->cardnumber,
331
           $newpatron->{ cardnumber }, 'Patron is really updated!');
331
           $newpatron->{ cardnumber }, 'Patron is really updated!');
332
332
333
        my $superlibrarian = $builder->build_object(
334
            {
335
                class => 'Koha::Patrons',
336
                value => { flags => 1 }
337
            }
338
        );
339
340
        $newpatron->{cardnumber} = $superlibrarian->cardnumber;
341
        $newpatron->{userid}     = $superlibrarian->userid;
342
        $newpatron->{email}      = 'nosense@no.no';
343
344
        $authorized_patron->flags( 2**4 )->store; # borrowers flag = 4
345
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
346
          ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
347
          ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } );
348
333
        $schema->storage->txn_rollback;
349
        $schema->storage->txn_rollback;
334
    };
350
    };
335
};
351
};
336
- 

Return to bug 23634