From 45392cd9c84079288da0f305bd7a0b1f7dd0326a Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Wed, 18 Sep 2024 08:49:47 +0000 Subject: [PATCH] Bug 28907: REST - Remove allow-owner from public patron hold cancellation To test: 1. prove t/db_dependent/api/v1/patrons_holds.t 2. Apply patch 3. prove t/db_dependent/api/v1/patrons_holds.t Signed-off-by: Victor Grousset/tuxayo --- Koha/REST/V1/Patrons/Holds.pm | 4 ++++ api/v1/swagger/paths/public_patrons.yaml | 2 -- t/db_dependent/api/v1/patrons_holds.t | 11 ++++++++++- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/Koha/REST/V1/Patrons/Holds.pm b/Koha/REST/V1/Patrons/Holds.pm index 99b094b7e9..0d8b26e6f7 100644 --- a/Koha/REST/V1/Patrons/Holds.pm +++ b/Koha/REST/V1/Patrons/Holds.pm @@ -21,6 +21,8 @@ use Mojo::Base 'Mojolicious::Controller'; use Koha::Patrons; +use Try::Tiny; + =head1 NAME Koha::REST::V1::Patrons::Holds @@ -72,6 +74,8 @@ sub delete_public { my $c = shift->openapi->valid_input or return; return try { + $c->auth->public( $c->param('patron_id') ); + my $hold = $c->objects->find_rs( Koha::Holds->new, $c->param('hold_id') ); unless ( $hold and $c->param('patron_id') == $hold->borrowernumber ) { diff --git a/api/v1/swagger/paths/public_patrons.yaml b/api/v1/swagger/paths/public_patrons.yaml index 774533a445..309072da02 100644 --- a/api/v1/swagger/paths/public_patrons.yaml +++ b/api/v1/swagger/paths/public_patrons.yaml @@ -278,5 +278,3 @@ description: Under maintenance schema: $ref: "../swagger.yaml#/definitions/error" - x-koha-authorization: - allow-owner: true diff --git a/t/db_dependent/api/v1/patrons_holds.t b/t/db_dependent/api/v1/patrons_holds.t index ffe6f56f0d..005a69fda3 100755 --- a/t/db_dependent/api/v1/patrons_holds.t +++ b/t/db_dependent/api/v1/patrons_holds.t @@ -93,7 +93,7 @@ subtest 'list() tests' => sub { subtest 'delete_public() tests' => sub { - plan tests => 13; + plan tests => 18; $schema->storage->txn_begin; @@ -113,11 +113,20 @@ subtest 'delete_public() tests' => sub { my $deleted_hold_id = $hold_to_delete->id; $hold_to_delete->delete; + $t->delete_ok( "/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id )->status_is(401) + ->json_is( { error => 'Authentication failure.' } ); + $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id ) ->status_is(404); my $another_user_hold = $builder->build_object( { class => 'Koha::Holds' } ); + $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" + . $another_user_hold->borrowernumber + . '/holds/' + . $another_user_hold->id ) + ->json_is( { error => "Unprivileged user cannot access another user's resources" } ); + $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $another_user_hold->id ) ->status_is( 404, 'Invalid patron_id and hold_id combination yields 404' ); -- 2.46.2