From 8e1a0e9cdf8feaab112f7405ccd6c492de90b350 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Wed, 18 Sep 2024 08:44:46 +0000 Subject: [PATCH] Bug 28907: REST - Remove allow-owner from public checkouts route To test: 1. prove t/db_dependent/api/v1/checkouts.t 2. Apply patch 3. prove t/db_dependent/api/v1/checkouts.t Observe success in both cases. --- Koha/REST/V1/Checkouts.pm | 25 ++++++++++++------------ api/v1/swagger/paths/public_patrons.yaml | 2 -- t/db_dependent/api/v1/checkouts.t | 3 +-- 3 files changed, 14 insertions(+), 16 deletions(-) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index 301369a45c..793453613e 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -27,6 +27,7 @@ use Koha::Checkouts; use Koha::Old::Checkouts; use Koha::Token; +use Scalar::Util qw( blessed ); use Try::Tiny qw( catch try ); =head1 NAME @@ -190,19 +191,19 @@ sub add { my $patron_id = $body->{patron_id}; my $onsite = $body->{onsite_checkout}; - if ( $c->stash('is_public') - && !C4::Context->preference('OpacTrustedCheckout') ) - { - return $c->render( - status => 405, - openapi => { - error => 'Feature disabled', - error_code => 'FEATURE_DISABLED' - } - ); - } - return try { + if ( $c->stash('is_public') ) { + $c->auth->public($patron_id); + + return $c->render( + status => 405, + openapi => { + error => 'Feature disabled', + error_code => 'FEATURE_DISABLED' + } + ) if !C4::Context->preference('OpacTrustedCheckout'); + } + my $item = Koha::Items->find($item_id); unless ($item) { return $c->render( diff --git a/api/v1/swagger/paths/public_patrons.yaml b/api/v1/swagger/paths/public_patrons.yaml index 9a987ee0ed..0d1e48c6ca 100644 --- a/api/v1/swagger/paths/public_patrons.yaml +++ b/api/v1/swagger/paths/public_patrons.yaml @@ -130,8 +130,6 @@ description: Under maintenance schema: $ref: "../swagger.yaml#/definitions/error" - x-koha-authorization: - allow-owner: true "/public/patrons/{patron_id}/guarantors/can_see_charges": put: x-mojo-to: Patrons#guarantors_can_see_charges diff --git a/t/db_dependent/api/v1/checkouts.t b/t/db_dependent/api/v1/checkouts.t index 8f306df0e0..24ad12c38b 100755 --- a/t/db_dependent/api/v1/checkouts.t +++ b/t/db_dependent/api/v1/checkouts.t @@ -536,8 +536,7 @@ subtest 'add checkout' => sub { $t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json => { item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is( { - error => "Authorization failure. Missing required permission(s).", - required_permissions => undef + error => "Unprivileged user cannot access another user's resources" } ); -- 2.34.1