View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-2 / +22 lines)
Lines 106-112 sub authenticate_api_request { Link Here
106
    }
106
    }
107
107
108
    if ($action_spec->{'x-koha-permission'}) {
108
    if ($action_spec->{'x-koha-permission'}) {
109
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
109
        if (_allowOwner($c, $action_spec, $user)) {
110
            return $next->($c);
111
        }
112
        my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'};
113
114
        if (C4::Auth::haspermission($user->userid, $permissions)) {
110
            return $next->($c);
115
            return $next->($c);
111
        }
116
        }
112
        else {
117
        else {
Lines 122-125 sub authenticate_api_request { Link Here
122
    }
127
    }
123
}
128
}
124
129
130
sub _allowOwner {
131
    my ($c, $action_spec, $user) = @_;
132
133
    my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'};
134
135
    return unless $allowOwner && $allowOwner == 1;
136
    if ($c->param("borrowernumber")) {
137
        return $c->param("borrowernumber")
138
            && $user->borrowernumber == $c->param("borrowernumber");
139
    }
140
    elsif ($c->req->json && $c->req->json->{"borrowernumber"}) {
141
        return $c->req->json->{"borrowernumber"}
142
            && $user->borrowernumber == $c->req->json->{"borrowernumber"};
143
    }
144
}
145
125
1;
146
1;
126
- 

Return to bug 14868