From 455d5e0c3eb726c286498c66c031fe2b5a5d614a Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 24 Apr 2024 06:13:22 +0000 Subject: [PATCH] Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation This change adds a "validate_borrowers" permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission "validate_borrowers" appears under the "borrowers" permission --- api/v1/swagger/paths/auth.yaml | 3 ++- ...6561_add-new-validate-borrowers-permission.pl | 16 ++++++++++++++++ .../data/mysql/mandatory/userpermissions.sql | 1 + .../prog/en/includes/permissions.inc | 5 +++++ t/db_dependent/api/v1/password_validation.t | 15 ++++++++++++++- 5 files changed, 38 insertions(+), 2 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml index b9dee70cdca..5d29f194c53 100644 --- a/api/v1/swagger/paths/auth.yaml +++ b/api/v1/swagger/paths/auth.yaml @@ -1131,4 +1131,5 @@ $ref: ../swagger.yaml#/definitions/error x-koha-authorization: permissions: - borrowers: "1" + - borrowers: "validate_borrowers" + diff --git a/installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl b/installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl new file mode 100644 index 00000000000..fa3b484d625 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_36561_add-new-validate-borrowers-permission.pl @@ -0,0 +1,16 @@ +use Modern::Perl; + +return { + bug_number => "BUG_36561", + description => "Add new validate_borrowers permission", + up => sub { + my ($args) = @_; + my ( $dbh, $out ) = @$args{qw(dbh out)}; + + $dbh->do( + "INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (4, 'validate_borrowers', 'Check validity of username and password')" + ); + + say $out "Added new permission 'validate_borrowers'"; + }, +}; diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql index a132b83e204..13b77707f4e 100644 --- a/installer/data/mysql/mandatory/userpermissions.sql +++ b/installer/data/mysql/mandatory/userpermissions.sql @@ -47,6 +47,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES ( 4, 'delete_borrowers', 'Delete patrons'), ( 4, 'edit_borrowers', 'Add, modify and view patron information'), ( 4, 'list_borrowers', 'Search, list and view patrons'), + ( 4, 'validate_borrowers', 'Check validity of username and password'), ( 4, 'view_borrower_infos_from_any_libraries', 'View patron infos from any libraries'), ( 6, 'place_holds', 'Place holds for patrons'), ( 6, 'modify_holds_priority', 'Modify holds priority'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc index 64accc2e859..4d4cb91dc3b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -317,6 +317,11 @@ Search, list and view patrons ([% name | html %]) + [%- CASE 'validate_borrowers' -%] + + Check validity of username and password + + ([% name | html %]) [%- CASE 'view_borrower_infos_from_any_libraries' -%] View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. diff --git a/t/db_dependent/api/v1/password_validation.t b/t/db_dependent/api/v1/password_validation.t index 10527bc93d0..772895f6672 100755 --- a/t/db_dependent/api/v1/password_validation.t +++ b/t/db_dependent/api/v1/password_validation.t @@ -39,9 +39,22 @@ $schema->storage->txn_begin; my $librarian = $builder->build_object( { class => 'Koha::Patrons', - value => { flags => 2 ** 4 } # borrowers flag = 4 + value => { flags => 0 } #No top-level permissions } ); + +# Ensure our librarian can see users from all branches (once list_borrowers is added) +$builder->build( + { + source => 'UserPermission', + value => { + borrowernumber => $librarian->borrowernumber, + module_bit => 4, + code => 'validate_borrowers', + }, + } +); + my $password = 'thePassword123'; $librarian->set_password( { password => $password, skip_validation => 1 } ); my $userid = $librarian->userid; -- 2.30.2