From 270914eea125e23239bb5d57d1586a164ff4fe2a Mon Sep 17 00:00:00 2001 From: Johanna Raisa Date: Tue, 17 May 2022 08:58:15 +0300 Subject: [PATCH] Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API This patch enables librarians with only "place_holds" permissions to cancel, suspend and resume holds via REST API. Test plan: 1) Try to cancel or suspend a hold with only "place_holds" permissions 2) See that it is forbidden. 3) Apply the patch 4) Cancel a hold again 5) The cancellation succeeds 6) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy --- api/v1/swagger/paths/holds.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/api/v1/swagger/paths/holds.yaml b/api/v1/swagger/paths/holds.yaml index 9641b69435..617eb3d9d3 100644 --- a/api/v1/swagger/paths/holds.yaml +++ b/api/v1/swagger/paths/holds.yaml @@ -401,7 +401,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - reserveforothers: "1" + reserveforothers: place_holds "/holds/{hold_id}/priority": put: x-mojo-to: Holds#update_priority @@ -511,7 +511,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - reserveforothers: "1" + reserveforothers: place_holds delete: x-mojo-to: Holds#resume operationId: resumeHold @@ -556,7 +556,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - reserveforothers: "1" + reserveforothers: place_holds "/holds/{hold_id}/pickup_locations": get: x-mojo-to: Holds#pickup_locations -- 2.25.1