From 8827d02370038bb4c89e6bbe828b2d0a97a1c37f Mon Sep 17 00:00:00 2001 From: Matt Blenkinsop Date: Wed, 21 Dec 2022 16:56:01 +0000 Subject: [PATCH] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested --- api/v1/swagger/paths/patrons.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api/v1/swagger/paths/patrons.yaml b/api/v1/swagger/paths/patrons.yaml index 1100a9fba96..01a8a89a87d 100644 --- a/api/v1/swagger/paths/patrons.yaml +++ b/api/v1/swagger/paths/patrons.yaml @@ -501,7 +501,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - borrowers: edit_borrowers + borrowers: view_borrower_infos_from_any_libraries put: x-mojo-to: Patrons#update operationId: updatePatron -- 2.37.1 (Apple Git-137.1)