View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1/Patron.pm (-10 lines)
Lines 26-34 sub list { Link Here
26
    my ($c, $args, $cb) = @_;
26
    my ($c, $args, $cb) = @_;
27
27
28
    my $user = $c->stash('koha.user');
28
    my $user = $c->stash('koha.user');
29
    unless ($user && haspermission($user->userid, {borrowers => 1})) {
30
        return $c->$cb({error => "You don't have the required permission"}, 403);
31
    }
32
29
33
    my $patrons = Koha::Patrons->search;
30
    my $patrons = Koha::Patrons->search;
34
31
Lines 40-52 sub get { Link Here
40
37
41
    my $user = $c->stash('koha.user');
38
    my $user = $c->stash('koha.user');
42
39
43
    unless ( $user
44
        && ( $user->borrowernumber == $args->{borrowernumber}
45
            || haspermission($user->userid, {borrowers => 1}) ) )
46
    {
47
        return $c->$cb({error => "You don't have the required permission"}, 403);
48
    }
49
50
    my $patron = Koha::Patrons->find($args->{borrowernumber});
40
    my $patron = Koha::Patrons->find($args->{borrowernumber});
51
    unless ($patron) {
41
    unless ($patron) {
52
        return $c->$cb({error => "Patron not found"}, 404);
42
        return $c->$cb({error => "Patron not found"}, 404);
(-)a/api/v1/swagger/paths/holds.json (+25 lines)
Lines 124-129 Link Here
124
            "$ref": "../definitions.json#/error"
124
            "$ref": "../definitions.json#/error"
125
          }
125
          }
126
        }
126
        }
127
      },
128
      "x-koha-authorization": {
129
        "allow-owner": true,
130
        "allow-guarantor": true,
131
        "permissions": {
132
          "borrowers": "1"
133
        }
127
      }
134
      }
128
    },
135
    },
129
    "post": {
136
    "post": {
Lines 195-200 Link Here
195
            "$ref": "../definitions.json#/error"
202
            "$ref": "../definitions.json#/error"
196
          }
203
          }
197
        }
204
        }
205
      },
206
      "x-koha-authorization": {
207
        "allow-owner": true,
208
        "permissions": {
209
          "reserveforothers": "1"
210
        }
198
      }
211
      }
199
    }
212
    }
200
  },
213
  },
Lines 251-256 Link Here
251
            "$ref": "../definitions.json#/error"
264
            "$ref": "../definitions.json#/error"
252
          }
265
          }
253
        }
266
        }
267
      },
268
      "x-koha-authorization": {
269
        "allow-owner": true,
270
        "allow-guarantor": true,
271
        "permissions": {
272
          "reserveforothers": "1"
273
        }
254
      }
274
      }
255
    },
275
    },
256
    "delete": {
276
    "delete": {
Lines 274-279 Link Here
274
            "$ref": "../definitions.json#/error"
294
            "$ref": "../definitions.json#/error"
275
          }
295
          }
276
        }
296
        }
297
      },
298
      "x-koha-authorization": {
299
        "permissions": {
300
          "reserveforothers": "1"
301
        }
277
      }
302
      }
278
    }
303
    }
279
  }
304
  }
(-)a/api/v1/swagger/paths/patrons.json (+12 lines)
Lines 22-27 Link Here
22
            "$ref": "../definitions.json#/error"
22
            "$ref": "../definitions.json#/error"
23
          }
23
          }
24
        }
24
        }
25
      },
26
      "x-koha-authorization": {
27
        "permissions": {
28
          "borrowers": "1"
29
        }
25
      }
30
      }
26
    }
31
    }
27
  },
32
  },
Lines 55-60 Link Here
55
            "$ref": "../definitions.json#/error"
60
            "$ref": "../definitions.json#/error"
56
          }
61
          }
57
        }
62
        }
63
      },
64
      "x-koha-authorization": {
65
        "allow-owner": true,
66
        "allow-guarantor": true,
67
        "permissions": {
68
          "borrowers": "1"
69
        }
58
      }
70
      }
59
    }
71
    }
60
  }
72
  }
(-)a/t/db_dependent/api/v1/holds.t (-62 / +218 lines)
Lines 17-24 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 39;
20
use Test::More tests => 4;
21
use Test::Mojo;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
22
23
23
use DateTime;
24
use DateTime;
24
25
Lines 30-48 use C4::Reserves; Link Here
30
use Koha::Database;
31
use Koha::Database;
31
use Koha::Patron;
32
use Koha::Patron;
32
33
34
my $builder = t::lib::TestBuilder->new();
35
33
my $dbh = C4::Context->dbh;
36
my $dbh = C4::Context->dbh;
34
$dbh->{AutoCommit} = 0;
37
$dbh->{AutoCommit} = 0;
35
$dbh->{RaiseError} = 1;
38
$dbh->{RaiseError} = 1;
36
39
40
$ENV{REMOTE_ADDR} = '127.0.0.1';
37
my $t = Test::Mojo->new('Koha::REST::V1');
41
my $t = Test::Mojo->new('Koha::REST::V1');
42
my $tx;
38
43
39
my $categorycode = Koha::Database->new()->schema()->resultset('Category')->first()->categorycode();
44
my $categorycode = Koha::Database->new()->schema()->resultset('Category')->first()->categorycode();
40
my $branchcode = Koha::Database->new()->schema()->resultset('Branch')->first()->branchcode();
45
my $branchcode = Koha::Database->new()->schema()->resultset('Branch')->first()->branchcode();
41
46
47
# User without any permissions
48
my $nopermission = $builder->build({
49
    source => 'Borrower',
50
    value => {
51
        branchcode   => $branchcode,
52
        categorycode => $categorycode,
53
        flags        => 0
54
    }
55
});
56
my $session_nopermission = C4::Auth::get_session('');
57
$session_nopermission->param('number', $nopermission->{ borrowernumber });
58
$session_nopermission->param('id', $nopermission->{ userid });
59
$session_nopermission->param('ip', '127.0.0.1');
60
$session_nopermission->param('lasttime', time());
61
$session_nopermission->flush;
62
42
my $borrower = Koha::Patron->new;
63
my $borrower = Koha::Patron->new;
43
$borrower->categorycode( $categorycode );
64
$borrower->categorycode( $categorycode );
44
$borrower->branchcode( $branchcode );
65
$borrower->branchcode( $branchcode );
45
$borrower->surname("Test Surname");
66
$borrower->surname("Test Surname");
67
$borrower->flags(80); #borrowers and reserveforothers flags
68
$borrower->userid($nopermission->{ userid }."z");
46
$borrower->store;
69
$borrower->store;
47
my $borrowernumber = $borrower->borrowernumber;
70
my $borrowernumber = $borrower->borrowernumber;
48
71
Lines 50-58 my $borrower2 = Koha::Patron->new; Link Here
50
$borrower2->categorycode( $categorycode );
73
$borrower2->categorycode( $categorycode );
51
$borrower2->branchcode( $branchcode );
74
$borrower2->branchcode( $branchcode );
52
$borrower2->surname("Test Surname 2");
75
$borrower2->surname("Test Surname 2");
76
$borrower2->userid($nopermission->{ userid }."x");
77
$borrower2->flags(16); # borrowers flag
53
$borrower2->store;
78
$borrower2->store;
54
my $borrowernumber2 = $borrower2->borrowernumber;
79
my $borrowernumber2 = $borrower2->borrowernumber;
55
80
81
my $borrower3 = Koha::Patron->new;
82
$borrower3->categorycode( $categorycode );
83
$borrower3->branchcode( $branchcode );
84
$borrower3->surname("Test Surname 2");
85
$borrower3->userid($nopermission->{ userid }."y");
86
$borrower3->flags(64); # reserveforothers flag
87
$borrower3->store;
88
my $borrowernumber3 = $borrower3->borrowernumber;
89
90
# Get sessions
91
my $session = C4::Auth::get_session('');
92
$session->param('number', $borrower->borrowernumber);
93
$session->param('id', $borrower->userid);
94
$session->param('ip', '127.0.0.1');
95
$session->param('lasttime', time());
96
$session->flush;
97
my $session2 = C4::Auth::get_session('');
98
$session2->param('number', $borrower2->borrowernumber);
99
$session2->param('id', $borrower2->userid);
100
$session2->param('ip', '127.0.0.1');
101
$session2->param('lasttime', time());
102
$session2->flush;
103
my $session3 = C4::Auth::get_session('');
104
$session3->param('number', $borrower3->borrowernumber);
105
$session3->param('id', $borrower3->userid);
106
$session3->param('ip', '127.0.0.1');
107
$session3->param('lasttime', time());
108
$session3->flush;
109
56
my $biblionumber = create_biblio('RESTful Web APIs');
110
my $biblionumber = create_biblio('RESTful Web APIs');
57
my $itemnumber = create_item($biblionumber, 'TEST000001');
111
my $itemnumber = create_item($biblionumber, 'TEST000001');
58
112
Lines 62-120 my $reserve_id = C4::Reserves::AddReserve($branchcode, $borrowernumber, Link Here
62
    $biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);
116
    $biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);
63
117
64
# Add another reserve to be able to change first reserve's rank
118
# Add another reserve to be able to change first reserve's rank
65
C4::Reserves::AddReserve($branchcode, $borrowernumber2,
119
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $borrowernumber2,
66
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
120
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
67
121
68
$t->get_ok('/api/v1/holds')
69
    ->status_is(200)
70
    ->json_has('/0')
71
    ->json_has('/1')
72
    ->json_hasnt('/2');
73
74
$t->get_ok('/api/v1/holds?priority=2')
75
    ->status_is(200)
76
    ->json_is('/0/borrowernumber', $borrowernumber2)
77
    ->json_hasnt('/1');
78
79
my $suspend_until = DateTime->now->add(days => 10)->ymd;
122
my $suspend_until = DateTime->now->add(days => 10)->ymd;
80
my $put_data = {
81
    priority => 2,
82
    suspend_until => $suspend_until,
83
};
84
$t->put_ok("/api/v1/holds/$reserve_id" => json => $put_data)
85
  ->status_is(200)
86
  ->json_is('/reserve_id', $reserve_id)
87
  ->json_is('/suspend_until', $suspend_until . ' 00:00:00')
88
  ->json_is('/priority', 2);
89
90
$t->delete_ok("/api/v1/holds/$reserve_id")
91
  ->status_is(200);
92
93
$t->put_ok("/api/v1/holds/$reserve_id" => json => $put_data)
94
  ->status_is(404)
95
  ->json_has('/error');
96
97
$t->delete_ok("/api/v1/holds/$reserve_id")
98
  ->status_is(404)
99
  ->json_has('/error');
100
101
102
$t->get_ok("/api/v1/holds?borrowernumber=$borrowernumber")
103
  ->status_is(200)
104
  ->json_is([]);
105
106
my $inexisting_borrowernumber = $borrowernumber2 + 1;
107
$t->get_ok("/api/v1/holds?borrowernumber=$inexisting_borrowernumber")
108
  ->status_is(200)
109
  ->json_is([]);
110
111
$dbh->do('DELETE FROM issuingrules');
112
$dbh->do(q{
113
    INSERT INTO issuingrules (categorycode, branchcode, itemtype, reservesallowed)
114
    VALUES (?, ?, ?, ?)
115
}, {}, '*', '*', '*', 1);
116
117
my $expirationdate = DateTime->now->add(days => 10)->ymd;
123
my $expirationdate = DateTime->now->add(days => 10)->ymd;
124
118
my $post_data = {
125
my $post_data = {
119
    borrowernumber => int($borrowernumber),
126
    borrowernumber => int($borrowernumber),
120
    biblionumber => int($biblionumber),
127
    biblionumber => int($biblionumber),
Lines 122-142 my $post_data = { Link Here
122
    branchcode => $branchcode,
129
    branchcode => $branchcode,
123
    expirationdate => $expirationdate,
130
    expirationdate => $expirationdate,
124
};
131
};
125
$t->post_ok("/api/v1/holds" => json => $post_data)
132
my $put_data = {
126
  ->status_is(201)
133
    priority => 2,
127
  ->json_has('/reserve_id');
134
    suspend_until => $suspend_until,
135
};
136
137
subtest "Test endpoints without authentication" => sub {
138
    plan tests => 8;
139
    $t->get_ok('/api/v1/holds')
140
      ->status_is(401);
141
    $t->post_ok('/api/v1/holds')
142
      ->status_is(401);
143
    $t->put_ok('/api/v1/holds/0')
144
      ->status_is(401);
145
    $t->delete_ok('/api/v1/holds/0')
146
      ->status_is(401);
147
};
128
148
129
$reserve_id = $t->tx->res->json->{reserve_id};
130
149
131
$t->get_ok("/api/v1/holds?borrowernumber=$borrowernumber")
150
subtest "Test endpoints without permission" => sub {
132
  ->status_is(200)
151
    plan tests => 10;
133
  ->json_is('/0/reserve_id', $reserve_id)
152
134
  ->json_is('/0/expirationdate', $expirationdate)
153
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");
135
  ->json_is('/0/branchcode', $branchcode);
154
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
155
    $t->request_ok($tx) # no permission
156
      ->status_is(403);
157
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");
158
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
159
    $t->request_ok($tx) # reserveforothers permission
160
      ->status_is(403);
161
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data );
162
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
163
    $t->request_ok($tx) # no permission
164
      ->status_is(403);
165
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/0" => json => $put_data );
166
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
167
    $t->request_ok($tx) # no permission
168
      ->status_is(403);
169
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/0");
170
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
171
    $t->request_ok($tx) # no permission
172
      ->status_is(403);
173
};
174
subtest "Test endpoints without permission, but accessing own object" => sub {
175
    plan tests => 15;
176
177
    my $borrno_tmp = $post_data->{'borrowernumber'};
178
    $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'};
179
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
180
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
181
    $t->request_ok($tx) # create hold to myself
182
      ->status_is(201)
183
      ->json_has('/reserve_id');
184
185
    $post_data->{'borrowernumber'} = $borrno_tmp;
186
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber });
187
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
188
    $t->request_ok($tx) # get my own holds
189
      ->status_is(200)
190
      ->json_is('/0/borrowernumber', $nopermission->{ borrowernumber })
191
      ->json_is('/0/biblionumber', $biblionumber)
192
      ->json_is('/0/itemnumber', $itemnumber)
193
      ->json_is('/0/expirationdate', $expirationdate)
194
      ->json_is('/0/branchcode', $branchcode);
195
196
    my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id;
197
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data);
198
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
199
    $t->request_ok($tx) # create hold to myself
200
      ->status_is(200)
201
      ->json_is('/reserve_id', $reserve_id3)
202
      ->json_is('/suspend_until', $suspend_until . ' 00:00:00')
203
      ->json_is('/priority', 2);
204
};
136
205
137
$t->post_ok("/api/v1/holds" => json => $post_data)
206
subtest "Test endpoints with permission" => sub {
138
  ->status_is(403)
207
    plan tests => 42;
139
  ->json_like('/error', qr/tooManyReserves/);
208
209
    $tx = $t->ua->build_tx(GET => '/api/v1/holds');
210
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
211
    $t->request_ok($tx)
212
      ->status_is(200)
213
      ->json_has('/0')
214
      ->json_has('/1')
215
      ->json_has('/2')
216
      ->json_hasnt('/3');
217
218
    $tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2');
219
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
220
    $t->request_ok($tx)
221
      ->status_is(200)
222
      ->json_is('/0/borrowernumber', $nopermission->{borrowernumber})
223
      ->json_hasnt('/1');
224
225
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);
226
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
227
    $t->request_ok($tx)
228
      ->status_is(200)
229
      ->json_is('/reserve_id', $reserve_id)
230
      ->json_is('/suspend_until', $suspend_until . ' 00:00:00')
231
      ->json_is('/priority', 2);
232
233
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
234
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
235
    $t->request_ok($tx)
236
      ->status_is(200);
237
238
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);
239
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
240
    $t->request_ok($tx)
241
      ->status_is(404)
242
      ->json_has('/error');
243
244
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
245
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
246
    $t->request_ok($tx)
247
      ->status_is(404)
248
      ->json_has('/error');
249
250
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$borrower->borrowernumber);
251
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
252
    $t->request_ok($tx)
253
      ->status_is(200)
254
      ->json_is([]);
255
256
    my $inexisting_borrowernumber = $borrowernumber2*2;
257
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");
258
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
259
    $t->request_ok($tx)
260
      ->status_is(200)
261
      ->json_is([]);
262
263
    $dbh->do('DELETE FROM issuingrules');
264
    $dbh->do(q{
265
        INSERT INTO issuingrules (categorycode, branchcode, itemtype, reservesallowed)
266
        VALUES (?, ?, ?, ?)
267
    }, {}, '*', '*', '*', 1);
268
269
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id2");
270
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
271
    $t->request_ok($tx)
272
      ->status_is(200);
273
274
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
275
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
276
    $t->request_ok($tx)
277
      ->status_is(201)
278
      ->json_has('/reserve_id');
279
    $reserve_id = $t->tx->res->json->{reserve_id};
280
281
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");
282
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
283
    $t->request_ok($tx)
284
      ->status_is(200)
285
      ->json_is('/0/reserve_id', $reserve_id)
286
      ->json_is('/0/expirationdate', $expirationdate)
287
      ->json_is('/0/branchcode', $branchcode);
288
289
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
290
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
291
    $t->request_ok($tx)
292
      ->status_is(403)
293
      ->json_like('/error', qr/tooManyReserves/);
294
};
140
295
141
296
142
$dbh->rollback;
297
$dbh->rollback;
Lines 160-165 sub create_item { Link Here
160
    my $item = {
315
    my $item = {
161
        barcode => $barcode,
316
        barcode => $barcode,
162
    };
317
    };
318
    $dbh->do("DELETE FROM items WHERE barcode='$barcode'") if $barcode;
163
319
164
    my $itemnumber = C4::Items::AddItem($item, $biblionumber);
320
    my $itemnumber = C4::Items::AddItem($item, $biblionumber);
165
321
(-)a/t/db_dependent/api/v1/patrons.t (-6 / +52 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 10;
20
use Test::More tests => 19;
21
use Test::Mojo;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
22
use t::lib::TestBuilder;
23
23
Lines 38-57 my $t = Test::Mojo->new('Koha::REST::V1'); Link Here
38
38
39
my $categorycode = $builder->build({ source => 'Category' })->{ categorycode };
39
my $categorycode = $builder->build({ source => 'Category' })->{ categorycode };
40
my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
40
my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
41
my $guarantor = $builder->build({
42
    source => 'Borrower',
43
    value => {
44
        branchcode   => $branchcode,
45
        categorycode => $categorycode,
46
        flags        => 0,
47
    }
48
});
41
my $borrower = $builder->build({
49
my $borrower = $builder->build({
42
    source => 'Borrower',
50
    source => 'Borrower',
43
    value => {
51
    value => {
44
        branchcode   => $branchcode,
52
        branchcode   => $branchcode,
45
        categorycode => $categorycode
53
        categorycode => $categorycode,
54
        flags        => 0,
55
        guarantorid    => $guarantor->{borrowernumber},
46
    }
56
    }
47
});
57
});
48
58
49
$t->get_ok('/api/v1/patrons')
59
$t->get_ok('/api/v1/patrons')
50
  ->status_is(403);
60
  ->status_is(401);
51
61
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
62
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
63
  ->status_is(401);
64
65
my $session = C4::Auth::get_session('');
66
$session->param('number', $borrower->{ borrowernumber });
67
$session->param('id', $borrower->{ userid });
68
$session->param('ip', '127.0.0.1');
69
$session->param('lasttime', time());
70
$session->flush;
71
72
my $session2 = C4::Auth::get_session('');
73
$session2->param('number', $guarantor->{ borrowernumber });
74
$session2->param('id', $guarantor->{ userid });
75
$session2->param('ip', '127.0.0.1');
76
$session2->param('lasttime', time());
77
$session2->flush;
78
79
my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
80
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
81
$t->request_ok($tx)
82
  ->status_is(403);
83
84
$tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . ($borrower->{ borrowernumber }-1));
85
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
86
$t->request_ok($tx)
53
  ->status_is(403);
87
  ->status_is(403);
54
88
89
# User without permissions, but is the owner of the object
90
$tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $borrower->{borrowernumber});
91
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
92
$t->request_ok($tx)
93
  ->status_is(200);
94
95
# User without permissions, but is the guarantor of the owner of the object
96
$tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $borrower->{borrowernumber});
97
$tx->req->cookies({name => 'CGISESSID', value => $session2->id});
98
$t->request_ok($tx)
99
  ->status_is(200)
100
  ->json_is('/guarantorid', $guarantor->{borrowernumber});
101
55
my $loggedinuser = $builder->build({
102
my $loggedinuser = $builder->build({
56
    source => 'Borrower',
103
    source => 'Borrower',
57
    value => {
104
    value => {
Lines 61-74 my $loggedinuser = $builder->build({ Link Here
61
    }
108
    }
62
});
109
});
63
110
64
my $session = C4::Auth::get_session('');
111
$session = C4::Auth::get_session('');
65
$session->param('number', $loggedinuser->{ borrowernumber });
112
$session->param('number', $loggedinuser->{ borrowernumber });
66
$session->param('id', $loggedinuser->{ userid });
113
$session->param('id', $loggedinuser->{ userid });
67
$session->param('ip', '127.0.0.1');
114
$session->param('ip', '127.0.0.1');
68
$session->param('lasttime', time());
115
$session->param('lasttime', time());
69
$session->flush;
116
$session->flush;
70
117
71
my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
118
$tx = $t->ua->build_tx(GET => '/api/v1/patrons');
72
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
119
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
73
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
120
$tx->req->env({REMOTE_ADDR => '127.0.0.1'});
74
$t->request_ok($tx)
121
$t->request_ok($tx)
75
- 

Return to bug 14868