View | Details | Raw Unified | Return to bug 17428
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-5 / +19 lines)
Lines 91-111 sub authenticate_api_request { Link Here
91
        ) if $cookie and $action_spec->{'x-koha-authorization'};
91
        ) if $cookie and $action_spec->{'x-koha-authorization'};
92
    }
92
    }
93
93
94
    my @errors = validate_parameters( $c, $action_spec );
95
    return $c->render_swagger({}, \@errors, 400) if @errors;
96
94
97
    return $next->($c) unless $action_spec->{'x-koha-authorization'};
95
    # Then check the parameters
96
    my @query_errors = validate_query_parameters( $c, $action_spec );
97
98
    # We do not need any authorization
99
    unless ( $action_spec->{'x-koha-authorization'} ) {
100
        return @query_errors
101
            ? $c->render_swagger({}, \@query_errors, 400)
102
            : $next->($c);
103
    }
104
98
    unless ($user) {
105
    unless ($user) {
99
        return $c->render_swagger({ error => "Authentication required." },{},401);
106
        return $c->render_swagger({ error => "Authentication required." },{},401);
100
    }
107
    }
101
108
102
    my $authorization = $action_spec->{'x-koha-authorization'};
109
    my $authorization = $action_spec->{'x-koha-authorization'};
103
    my $permissions = $authorization->{'permissions'};
110
    my $permissions = $authorization->{'permissions'};
111
112
    # Check if the user is authorized
104
    if ( C4::Auth::haspermission($user->userid, $permissions)
113
    if ( C4::Auth::haspermission($user->userid, $permissions)
105
        or allow_owner($c, $authorization, $user)
114
        or allow_owner($c, $authorization, $user)
106
        or allow_guarantor($c, $authorization, $user) ) {
115
        or allow_guarantor($c, $authorization, $user) ) {
116
117
        # Return the query errors if exist
118
        return $c->render_swagger({}, \@query_errors, 400) if @query_errors;
119
120
        # Everything is ok
107
        return $next->($c)
121
        return $next->($c)
108
    }
122
    }
123
109
    return $c->render_swagger(
124
    return $c->render_swagger(
110
        { error => "Authorization failure. Missing required permission(s).",
125
        { error => "Authorization failure. Missing required permission(s).",
111
          required_permissions => $permissions },
126
          required_permissions => $permissions },
Lines 114-120 sub authenticate_api_request { Link Here
114
    );
129
    );
115
}
130
}
116
131
117
sub validate_parameters {
132
sub validate_query_parameters {
118
    my ( $c, $action_spec ) = @_;
133
    my ( $c, $action_spec ) = @_;
119
134
120
    # Check for malformed query parameters
135
    # Check for malformed query parameters
121
- 

Return to bug 17428