From 464727333117ad2c3ceeebd0d56f271acdc174fd Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Fri, 17 Jun 2016 11:43:52 +0300 Subject: [PATCH] Bug 14868: Give users possibility to request their own object If the user has no required permissions, but attempts to access his own object, allow this request in case "x-koha-permission" has defined "allow-owner": "1". As an example, the following resource can be accessed if user has borrowers-flag or if he is making the request to his own borrowernumber (in path or body): "/patrons/{borrowernumber}": { .. "x-koha-permission": { "allow-owner": "1", "permissions": { "borrowers": "1" } } } Signed-off-by: Olli-Antti Kivilahti My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. --- Koha/REST/V1.pm | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm index c3f3ab6..568cbd5 100644 --- a/Koha/REST/V1.pm +++ b/Koha/REST/V1.pm @@ -105,7 +105,12 @@ sub authenticate_api_request { } if ($action_spec->{'x-koha-permission'}) { - if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { + if (_allowOwner($c, $action_spec, $user)) { + return $next->($c); + } + my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; + + if (C4::Auth::haspermission($user->userid, $permissions)) { return $next->($c); } else { @@ -121,4 +126,20 @@ sub authenticate_api_request { } } +sub _allowOwner { + my ($c, $action_spec, $user) = @_; + + my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; + + return unless $allowOwner && $allowOwner == 1; + if ($c->param("borrowernumber")) { + return $c->param("borrowernumber") + && $user->borrowernumber == $c->param("borrowernumber"); + } + elsif ($c->req->json && $c->req->json->{"borrowernumber"}) { + return $c->req->json->{"borrowernumber"} + && $user->borrowernumber == $c->req->json->{"borrowernumber"}; + } +} + 1; -- 1.9.1