View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-2 / +22 lines)
Lines 105-111 sub authenticate_api_request { Link Here
105
    }
105
    }
106
106
107
    if ($action_spec->{'x-koha-permission'}) {
107
    if ($action_spec->{'x-koha-permission'}) {
108
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
108
        if (_allowOwner($c, $action_spec, $user)) {
109
            return $next->($c);
110
        }
111
        my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'};
112
113
        if (C4::Auth::haspermission($user->userid, $permissions)) {
109
            return $next->($c);
114
            return $next->($c);
110
        }
115
        }
111
        else {
116
        else {
Lines 121-124 sub authenticate_api_request { Link Here
121
    }
126
    }
122
}
127
}
123
128
129
sub _allowOwner {
130
    my ($c, $action_spec, $user) = @_;
131
132
    my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'};
133
134
    return unless $allowOwner && $allowOwner == 1;
135
    if ($c->param("borrowernumber")) {
136
        return $c->param("borrowernumber")
137
            && $user->borrowernumber == $c->param("borrowernumber");
138
    }
139
    elsif ($c->req->json && $c->req->json->{"borrowernumber"}) {
140
        return $c->req->json->{"borrowernumber"}
141
            && $user->borrowernumber == $c->req->json->{"borrowernumber"};
142
    }
143
}
144
124
1;
145
1;
125
- 

Return to bug 14868