From 5ea05664c4eaff6754a8ab7420823958d899bbe7 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Wed, 19 Oct 2016 17:40:42 +0300 Subject: [PATCH] Bug 16330: (QA-follow-up) Fix permission for DELETE DELETE should not be allowed for user himself unless he has borrowers permission. Covered by a test. To test: 1. Apply patch 2. Run t/db_dependent/api/v1/patrons.t --- api/v1/swagger/paths/patrons.json | 2 -- t/db_dependent/api/v1/patrons.t | 8 +++++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/api/v1/swagger/paths/patrons.json b/api/v1/swagger/paths/patrons.json index 39f340a..6b55137 100644 --- a/api/v1/swagger/paths/patrons.json +++ b/api/v1/swagger/paths/patrons.json @@ -223,8 +223,6 @@ } }, "x-koha-authorization": { - "allow-owner": true, - "allow-guarantor": true, "permissions": { "borrowers": "1" } diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t index 716a2cd..f03f36d 100644 --- a/t/db_dependent/api/v1/patrons.t +++ b/t/db_dependent/api/v1/patrons.t @@ -17,7 +17,7 @@ use Modern::Perl; -use Test::More tests => 74; +use Test::More tests => 77; use Test::Mojo; use t::lib::TestBuilder; @@ -91,6 +91,12 @@ $t->request_ok($tx) ->status_is(403) ->json_is('/required_permissions', {"borrowers" => "1"}); +$tx = $t->ua->build_tx(DELETE => "/api/v1/patrons/" . $patron->{ borrowernumber }); +$tx->req->cookies({name => 'CGISESSID', value => $session->id}); +$t->request_ok($tx) + ->status_is(403) + ->json_is('/required_permissions', {"borrowers" => "1"}); + # User without permissions, but is the owner of the object $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $patron->{borrowernumber}); $tx->req->cookies({name => 'CGISESSID', value => $session->id}); -- 1.9.1