View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-2 / +22 lines)
Lines 84-90 sub authenticate_api_request { Link Here
84
    }
84
    }
85
85
86
    if ($action_spec->{'x-koha-permission'}) {
86
    if ($action_spec->{'x-koha-permission'}) {
87
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
87
        if (_allowOwner($c, $action_spec, $user)) {
88
            return $next->($c);
89
        }
90
        my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'};
91
92
        if (C4::Auth::haspermission($user->userid, $permissions)) {
88
            return $next->($c);
93
            return $next->($c);
89
        }
94
        }
90
        else {
95
        else {
Lines 100-103 sub authenticate_api_request { Link Here
100
    }
105
    }
101
}
106
}
102
107
108
sub _allowOwner {
109
    my ($c, $action_spec, $user) = @_;
110
111
    my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'};
112
113
    return unless $allowOwner && $allowOwner == 1;
114
    if ($c->param("borrowernumber")) {
115
        return $c->param("borrowernumber")
116
            && $user->borrowernumber == $c->param("borrowernumber");
117
    }
118
    elsif ($c->req->json && $c->req->json->{"borrowernumber"}) {
119
        return $c->req->json->{"borrowernumber"}
120
            && $user->borrowernumber == $c->req->json->{"borrowernumber"};
121
    }
122
}
123
103
1;
124
1;
104
- 

Return to bug 14868