From 18341b0f37a576310ed981080845875f7f9698b4 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Tue, 20 Apr 2021 14:23:36 -0300 Subject: [PATCH] Bug 28157: Add handling for the x-koha-library header This patch introduces a new header handling. The key idea is that on Koha's base classes there's broad usage of C4::Context->userenv to determine the current library and make decisions based on that. API requests, on the other hand, might not be tied to sessions (stateless) which is the way current library is retrieved. So we need a way to properly specify what library the request is trying to act as coming from. To test: 1. Apply this patchset 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t => SUCCESS: Tests pass! 3- Sign off :-D Signed-off-by: David Nind --- Koha/REST/V1/Auth.pm | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index a28fb5920c..3b5ab4c9a2 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -28,6 +28,7 @@ use Koha::ApiKeys; use Koha::Account::Lines; use Koha::Checkouts; use Koha::Holds; +use Koha::Libraries; use Koha::OAuth; use Koha::OAuthAccessTokens; use Koha::Old::Checkouts; @@ -310,7 +311,6 @@ sub validate_query_parameters { ) if @errors; } - =head3 allow_owner Allows access to object for its owner. @@ -500,19 +500,30 @@ Internal method that sets C4::Context->userenv sub _set_userenv { my ( $c, $patron ) = @_; - my $library = $patron->library; + my $passed_library_id = $c->req->headers->header('x-koha-library'); + my $THE_library; + + if ( $passed_library_id ) { + $THE_library = Koha::Libraries->find( $passed_library_id ); + Koha::Exceptions::Authorization::Unauthorized->throw( + "Unauthorized attempt to set library to $passed_library_id" + ) unless $THE_library and $patron->can_log_into($THE_library); + } + else { + $THE_library = $patron->library; + } C4::Context->_new_userenv( $patron->borrowernumber ); C4::Context->set_userenv( - $patron->borrowernumber, # number, - $patron->userid, # userid, - $patron->cardnumber, # cardnumber - $patron->firstname, # firstname - $patron->surname, # surname - $library->branchcode, # branch - $library->branchname, # branchname - $patron->flags, # flags, - $patron->email, # emailaddress + $patron->borrowernumber, # number, + $patron->userid, # userid, + $patron->cardnumber, # cardnumber + $patron->firstname, # firstname + $patron->surname, # surname + $THE_library->branchcode, # branch + $THE_library->branchname, # branchname + $patron->flags, # flags, + $patron->email, # emailaddress ); return $c; -- 2.11.0