View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-2 / +22 lines)
Lines 94-100 sub authenticate_api_request { Link Here
94
    }
94
    }
95
95
96
    if ($action_spec->{'x-koha-permission'}) {
96
    if ($action_spec->{'x-koha-permission'}) {
97
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
97
        if (_allowOwner($c, $action_spec, $user)) {
98
            return $next->($c);
99
        }
100
        my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'};
101
102
        if (C4::Auth::haspermission($user->userid, $permissions)) {
98
            return $next->($c);
103
            return $next->($c);
99
        }
104
        }
100
        else {
105
        else {
Lines 110-113 sub authenticate_api_request { Link Here
110
    }
115
    }
111
}
116
}
112
117
118
sub _allowOwner {
119
    my ($c, $action_spec, $user) = @_;
120
121
    my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'};
122
123
    return unless $allowOwner && $allowOwner == 1;
124
    if ($c->param("borrowernumber")) {
125
        return $c->param("borrowernumber")
126
            && $user->borrowernumber == $c->param("borrowernumber");
127
    }
128
    elsif ($c->req->json && $c->req->json->{"borrowernumber"}) {
129
        return $c->req->json->{"borrowernumber"}
130
            && $user->borrowernumber == $c->req->json->{"borrowernumber"};
131
    }
132
}
133
113
1;
134
1;
114
- 

Return to bug 14868