From 589267c577f0de71a6515d327c7196f83a4df50b Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Wed, 18 Sep 2024 08:44:46 +0000 Subject: [PATCH] Bug 28907: REST - Remove allow-owner from public checkouts route Content-Type: text/plain; charset=utf-8 To test: 1. prove t/db_dependent/api/v1/checkouts.t 2. Apply patch 3. prove t/db_dependent/api/v1/checkouts.t Observe success in both cases. Signed-off-by: Victor Grousset/tuxayo Signed-off-by: Marcel de Rooy --- Koha/REST/V1/Checkouts.pm | 25 ++++++++++++------------ api/v1/swagger/paths/public_patrons.yaml | 2 -- t/db_dependent/api/v1/checkouts.t | 3 +-- 3 files changed, 14 insertions(+), 16 deletions(-) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index a2c76c6efa..87362586a6 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -27,6 +27,7 @@ use Koha::Checkouts; use Koha::Old::Checkouts; use Koha::Token; +use Scalar::Util qw( blessed ); use Try::Tiny qw( catch try ); =head1 NAME @@ -191,18 +192,6 @@ sub add { my $onsite = $body->{onsite_checkout}; my $barcode = $body->{external_id}; - if ( $c->stash('is_public') - && !C4::Context->preference('OpacTrustedCheckout') ) - { - return $c->render( - status => 405, - openapi => { - error => 'Feature disabled', - error_code => 'FEATURE_DISABLED' - } - ); - } - return try { unless ( $item_id or $barcode ) { @@ -215,6 +204,18 @@ sub add { ); } + if ( $c->stash('is_public') ) { + $c->auth->public($patron_id); + + return $c->render( + status => 405, + openapi => { + error => 'Feature disabled', + error_code => 'FEATURE_DISABLED' + } + ) if !C4::Context->preference('OpacTrustedCheckout'); + } + my $item; if ($item_id) { $item = Koha::Items->find($item_id); diff --git a/api/v1/swagger/paths/public_patrons.yaml b/api/v1/swagger/paths/public_patrons.yaml index 9a987ee0ed..0d1e48c6ca 100644 --- a/api/v1/swagger/paths/public_patrons.yaml +++ b/api/v1/swagger/paths/public_patrons.yaml @@ -130,8 +130,6 @@ description: Under maintenance schema: $ref: "../swagger.yaml#/definitions/error" - x-koha-authorization: - allow-owner: true "/public/patrons/{patron_id}/guarantors/can_see_charges": put: x-mojo-to: Patrons#guarantors_can_see_charges diff --git a/t/db_dependent/api/v1/checkouts.t b/t/db_dependent/api/v1/checkouts.t index 779f00156a..7de6655717 100755 --- a/t/db_dependent/api/v1/checkouts.t +++ b/t/db_dependent/api/v1/checkouts.t @@ -554,8 +554,7 @@ subtest 'add checkout' => sub { $t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json => { item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is( { - error => "Authorization failure. Missing required permission(s).", - required_permissions => undef + error => "Unprivileged user cannot access another user's resources" } ); -- 2.39.5