View | Details | Raw Unified | Return to bug 23634
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons.pm (-2 / +15 lines)
Lines 209-218 sub update { Link Here
209
        my $user = $c->stash('koha.user');
209
        my $user = $c->stash('koha.user');
210
210
211
        if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) {
211
        if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) {
212
            my $put_email     = $body->{email} // qw{};
213
            my $db_email      = $patron->email // qw{};
214
            my $put_email_pro = $body->{secondary_email} // qw{};
215
            my $db_email_pro  = $patron->emailpro // qw{};
216
            my $put_email_B   = $body->{altaddress_email} // qw{};
217
            my $db_email_B    = $patron->B_email // qw{};
218
212
            return $c->render(
219
            return $c->render(
213
                status  => 403,
220
                status  => 403,
214
                openapi => { error => "Not enough privileges to change a superlibrarian's email" }
221
                openapi => {
215
            ) if $body->{email} ne $patron->email ;
222
                    error =>
223
                      "Not enough privileges to change a superlibrarian's email"
224
                }
225
              )
226
              if ($put_email ne $db_email)
227
              || ($put_email_pro ne $db_email_pro)
228
              || ($put_email_B ne $db_email_B);
216
        }
229
        }
217
230
218
        $patron->set_from_api($c->validation->param('body'))->store;
231
        $patron->set_from_api($c->validation->param('body'))->store;
(-)a/t/db_dependent/api/v1/patrons.t (-2 / +36 lines)
Lines 222-228 subtest 'update() tests' => sub { Link Here
222
    $schema->storage->txn_rollback;
222
    $schema->storage->txn_rollback;
223
223
224
    subtest 'librarian access tests' => sub {
224
    subtest 'librarian access tests' => sub {
225
        plan tests => 25;
225
        plan tests => 40;
226
226
227
        $schema->storage->txn_begin;
227
        $schema->storage->txn_begin;
228
228
Lines 341-351 subtest 'update() tests' => sub { Link Here
341
        $newpatron->{userid}     = $superlibrarian->userid;
341
        $newpatron->{userid}     = $superlibrarian->userid;
342
        $newpatron->{email}      = 'nosense@no.no';
342
        $newpatron->{email}      = 'nosense@no.no';
343
343
344
        # attempt to update
344
        $authorized_patron->flags( 2**4 )->store; # borrowers flag = 4
345
        $authorized_patron->flags( 2**4 )->store; # borrowers flag = 4
345
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
346
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
346
          ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
347
          ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
347
          ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } );
348
          ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } );
348
349
350
        # attempt to unset
351
        $newpatron->{email} = undef;
352
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
353
          ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
354
          ->json_is( { error => "Not enough privileges to change a superlibrarian's email to undefined" } );
355
356
        $newpatron->{email}           = $superlibrarian->email;
357
        $newpatron->{secondary_email} = 'nonsense@no.no';
358
359
        # attempt to update
360
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
361
          ->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email forbidden")
362
          ->json_is( { error => "Not enough privileges to change a superlibrarian's secondary_email" } );
363
364
        # attempt to unset
365
        $newpatron->{secondary_email} = undef;
366
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
367
          ->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email forbidden")
368
          ->json_is( { error => "Not enough privileges to change a superlibrarian's secondary_email to undefined" } );
369
370
        $newpatron->{secondary_email}  = $superlibrarian->emailpro;
371
        $newpatron->{altaddress_email} = 'nonsense@no.no';
372
373
        # attempt to update
374
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
375
          ->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email forbidden")
376
          ->json_is( { error => "Not enough privileges to change a superlibrarian's altaddress_email" } );
377
378
        # attempt to unset
379
        $newpatron->{altaddress_email} = undef;
380
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
381
          ->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email forbidden")
382
          ->json_is( { error => "Not enough privileges to change a superlibrarian's altaddress_email to undefined" } );
383
349
        $schema->storage->txn_rollback;
384
        $schema->storage->txn_rollback;
350
    };
385
    };
351
};
386
};
352
- 

Return to bug 23634