From 159c6eeb117234054df070b0bd2d025f5c6e7ee5 Mon Sep 17 00:00:00 2001 From: Matt Blenkinsop Date: Wed, 21 Dec 2022 16:56:01 +0000 Subject: [PATCH] Bug 32502: Api call to patrons/{patron_id} permission change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested Signed-off-by: Frédéric Demians Signed-off-by: Kyle M Hall --- api/v1/swagger/paths/patrons.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api/v1/swagger/paths/patrons.yaml b/api/v1/swagger/paths/patrons.yaml index 1100a9fba9..01a8a89a87 100644 --- a/api/v1/swagger/paths/patrons.yaml +++ b/api/v1/swagger/paths/patrons.yaml @@ -501,7 +501,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - borrowers: edit_borrowers + borrowers: view_borrower_infos_from_any_libraries put: x-mojo-to: Patrons#update operationId: updatePatron -- 2.30.2