View | Details | Raw Unified | Return to bug 13895
Collapse All | Expand All

(-)a/Koha/REST/V1/Checkout.pm (-7 / +20 lines)
Lines 20-25 use Modern::Perl; Link Here
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
use C4::Auth qw( haspermission );
22
use C4::Auth qw( haspermission );
23
use C4::Context;
23
use C4::Circulation;
24
use C4::Circulation;
24
use Koha::Issues;
25
use Koha::Issues;
25
26
Lines 27-33 sub list { Link Here
27
    my ($c, $args, $cb) = @_;
28
    my ($c, $args, $cb) = @_;
28
29
29
    my $user = $c->stash('koha.user');
30
    my $user = $c->stash('koha.user');
30
    unless ($user && haspermission($user->userid, { circulate => "circulate_remaining_permissions" })) {
31
    unless ($user && ($user->borrowernumber == $c->param('borrowernumber')
32
            || haspermission($user->userid, { circulate => "circulate_remaining_permissions" }))) {
31
        return $c->$cb({error => "You don't have the required permission"}, 403);
33
        return $c->$cb({error => "You don't have the required permission"}, 403);
32
    }
34
    }
33
35
Lines 43-51 sub get { Link Here
43
    my ($c, $args, $cb) = @_;
45
    my ($c, $args, $cb) = @_;
44
46
45
    my $user = $c->stash('koha.user');
47
    my $user = $c->stash('koha.user');
46
    unless ($user && haspermission($user->userid, { circulate => "circulate_remaining_permissions" })) {
47
        return $c->$cb({error => "You don't have the required permission"}, 403);
48
    }
49
48
50
    my $checkout_id = $args->{checkout_id};
49
    my $checkout_id = $args->{checkout_id};
51
    my $checkout = Koha::Issues->find($checkout_id);
50
    my $checkout = Koha::Issues->find($checkout_id);
Lines 56-61 sub get { Link Here
56
        }, 404);
55
        }, 404);
57
    }
56
    }
58
57
58
    my $borrowernumber = $checkout->borrowernumber;
59
60
    unless ($user && ( $user->borrowernumber == $borrowernumber
61
            || haspermission($user->userid, { circulate => "circulate_remaining_permissions" }))) {
62
        return $c->$cb({error => "You don't have the required permission"}, 403);
63
    }
64
59
    return $c->$cb($checkout->unblessed, 200);
65
    return $c->$cb($checkout->unblessed, 200);
60
}
66
}
61
67
Lines 63-71 sub renew { Link Here
63
    my ($c, $args, $cb) = @_;
69
    my ($c, $args, $cb) = @_;
64
70
65
    my $user = $c->stash('koha.user');
71
    my $user = $c->stash('koha.user');
66
    unless ($user && haspermission($user->userid, { circulate => "circulate_remaining_permissions" })) {
67
        return $c->$cb({error => "You don't have the required permission"}, 403);
68
    }
69
72
70
    my $checkout_id = $args->{checkout_id};
73
    my $checkout_id = $args->{checkout_id};
71
    my $checkout = Koha::Issues->find($checkout_id);
74
    my $checkout = Koha::Issues->find($checkout_id);
Lines 79-84 sub renew { Link Here
79
    my $borrowernumber = $checkout->borrowernumber;
82
    my $borrowernumber = $checkout->borrowernumber;
80
    my $itemnumber = $checkout->itemnumber;
83
    my $itemnumber = $checkout->itemnumber;
81
84
85
    my $OpacRenewalAllowed;
86
    if ($user->borrowernumber == $borrowernumber) {
87
        $OpacRenewalAllowed = C4::Context->preference('OpacRenewalAllowed');
88
    }
89
90
    unless ($user && ($OpacRenewalAllowed
91
            || haspermission($user->userid, { circulate => "circulate_remaining_permissions" }))) {
92
        return $c->$cb({error => "You don't have the required permission"}, 403);
93
    }
94
82
    my ($can_renew, $error) = C4::Circulation::CanBookBeRenewed(
95
    my ($can_renew, $error) = C4::Circulation::CanBookBeRenewed(
83
        $borrowernumber, $itemnumber);
96
        $borrowernumber, $itemnumber);
84
97
(-)a/t/db_dependent/api/v1/checkouts.t (-3 / +65 lines)
Lines 17-25 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 27;
20
use Test::More tests => 57;
21
use Test::MockModule;
21
use Test::MockModule;
22
use Test::Mojo;
22
use Test::Mojo;
23
use t::lib::Mocks;
23
use t::lib::TestBuilder;
24
use t::lib::TestBuilder;
24
25
25
use DateTime;
26
use DateTime;
Lines 59-66 $session->param('ip', '127.0.0.1'); Link Here
59
$session->param('lasttime', time());
60
$session->param('lasttime', time());
60
$session->flush;
61
$session->flush;
61
62
62
my $borrower = $builder->build({ source => 'Borrower' });
63
my $borrower = $builder->build({ source => 'Borrower', value => { flags => 0 } });
63
my $borrowernumber = $borrower->{borrowernumber};
64
my $borrowernumber = $borrower->{borrowernumber};
65
my $borrower_session = C4::Auth::get_session('');
66
$borrower_session->param('number', $borrowernumber);
67
$borrower_session->param('id', $borrower->{ userid });
68
$borrower_session->param('ip', '127.0.0.1');
69
$borrower_session->param('lasttime', time());
70
$borrower_session->flush;
64
71
65
my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
72
my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
66
my $module = new Test::MockModule('C4::Context');
73
my $module = new Test::MockModule('C4::Context');
Lines 82-93 $t->request_ok($tx) Link Here
82
my $biblionumber = create_biblio('RESTful Web APIs');
89
my $biblionumber = create_biblio('RESTful Web APIs');
83
my $itemnumber1 = create_item($biblionumber, 'TEST000001');
90
my $itemnumber1 = create_item($biblionumber, 'TEST000001');
84
my $itemnumber2 = create_item($biblionumber, 'TEST000002');
91
my $itemnumber2 = create_item($biblionumber, 'TEST000002');
92
my $itemnumber3 = create_item($biblionumber, 'TEST000003');
85
93
86
my $date_due = DateTime->now->add(weeks => 2);
94
my $date_due = DateTime->now->add(weeks => 2);
87
my $issue1 = C4::Circulation::AddIssue($borrower, 'TEST000001', $date_due);
95
my $issue1 = C4::Circulation::AddIssue($borrower, 'TEST000001', $date_due);
88
my $date_due1 = Koha::DateUtils::dt_from_string( $issue1->date_due );
96
my $date_due1 = Koha::DateUtils::dt_from_string( $issue1->date_due );
89
my $issue2 = C4::Circulation::AddIssue($borrower, 'TEST000002', $date_due);
97
my $issue2 = C4::Circulation::AddIssue($borrower, 'TEST000002', $date_due);
90
my $date_due2 = Koha::DateUtils::dt_from_string( $issue2->date_due );
98
my $date_due2 = Koha::DateUtils::dt_from_string( $issue2->date_due );
99
my $issue3 = C4::Circulation::AddIssue($loggedinuser, 'TEST000003', $date_due);
100
my $date_due3 = Koha::DateUtils::dt_from_string( $issue3->date_due );
91
101
92
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts?borrowernumber=$borrowernumber");
102
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts?borrowernumber=$borrowernumber");
93
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
103
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
Lines 101-106 $t->request_ok($tx) Link Here
101
  ->json_is('/1/date_due' => $date_due2->ymd . ' ' . $date_due2->hms)
111
  ->json_is('/1/date_due' => $date_due2->ymd . ' ' . $date_due2->hms)
102
  ->json_hasnt('/2');
112
  ->json_hasnt('/2');
103
113
114
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/".$issue3->issue_id);
115
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
116
$t->request_ok($tx)
117
  ->status_is(403)
118
  ->json_is({ error => "You don't have the required permission" });
119
120
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts?borrowernumber=".$loggedinuser->{borrowernumber});
121
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
122
$t->request_ok($tx)
123
  ->status_is(403)
124
  ->json_is({ error => "You don't have the required permission" });
125
126
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts?borrowernumber=$borrowernumber");
127
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
128
$t->request_ok($tx)
129
  ->status_is(200)
130
  ->json_is('/0/borrowernumber' => $borrowernumber)
131
  ->json_is('/0/itemnumber' => $itemnumber1)
132
  ->json_is('/0/date_due' => $date_due1->ymd . ' ' . $date_due1->hms)
133
  ->json_is('/1/borrowernumber' => $borrowernumber)
134
  ->json_is('/1/itemnumber' => $itemnumber2)
135
  ->json_is('/1/date_due' => $date_due2->ymd . ' ' . $date_due2->hms)
136
  ->json_hasnt('/2');
137
138
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/" . $issue1->issue_id);
139
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
140
$t->request_ok($tx)
141
  ->status_is(200)
142
  ->json_is('/borrowernumber' => $borrowernumber)
143
  ->json_is('/itemnumber' => $itemnumber1)
144
  ->json_is('/date_due' => $date_due1->ymd . ' ' . $date_due1->hms)
145
  ->json_hasnt('/1');
146
104
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/" . $issue1->issue_id);
147
$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/" . $issue1->issue_id);
105
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
148
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
106
$t->request_ok($tx)
149
$t->request_ok($tx)
Lines 127-132 $t->request_ok($tx) Link Here
127
  ->status_is(200)
170
  ->status_is(200)
128
  ->json_is('/date_due' => $expected_datedue->ymd . ' ' . $expected_datedue->hms);
171
  ->json_is('/date_due' => $expected_datedue->ymd . ' ' . $expected_datedue->hms);
129
172
173
$tx = $t->ua->build_tx(PUT => "/api/v1/checkouts/" . $issue3->issue_id);
174
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
175
$t->request_ok($tx)
176
  ->status_is(403)
177
  ->json_is({ error => "You don't have the required permission" });
178
179
t::lib::Mocks::mock_preference( "OpacRenewalAllowed", 0 );
180
$tx = $t->ua->build_tx(PUT => "/api/v1/checkouts/" . $issue2->issue_id);
181
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
182
$t->request_ok($tx)
183
  ->status_is(403)
184
  ->json_is({ error => "You don't have the required permission" });
185
186
t::lib::Mocks::mock_preference( "OpacRenewalAllowed", 1 );
187
$tx = $t->ua->build_tx(PUT => "/api/v1/checkouts/" . $issue2->issue_id);
188
$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
189
$t->request_ok($tx)
190
  ->status_is(200)
191
  ->json_is('/date_due' => $expected_datedue->ymd . ' ' . $expected_datedue->hms);
192
130
$tx = $t->ua->build_tx(PUT => "/api/v1/checkouts/" . $issue1->issue_id);
193
$tx = $t->ua->build_tx(PUT => "/api/v1/checkouts/" . $issue1->issue_id);
131
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
194
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
132
$t->request_ok($tx)
195
$t->request_ok($tx)
133
- 

Return to bug 13895