View | Details | Raw Unified | Return to bug 17565
Collapse All | Expand All

(-)a/Koha/REST/V1/Hold.pm (+9 lines)
Lines 148-158 sub delete { Link Here
148
148
149
    my $reserve_id = $args->{reserve_id};
149
    my $reserve_id = $args->{reserve_id};
150
    my $reserve = C4::Reserves::GetReserve($reserve_id);
150
    my $reserve = C4::Reserves::GetReserve($reserve_id);
151
    my $user = $c->stash('koha.user');
151
152
152
    unless ($reserve) {
153
    unless ($reserve) {
153
        return $c->$cb({error => "Reserve not found"}, 404);
154
        return $c->$cb({error => "Reserve not found"}, 404);
154
    }
155
    }
155
156
157
    if ($user
158
        && ($c->stash('is_owner_access') || $c->stash('is_guarantor_access'))
159
        && !C4::Reserves::CanReserveBeCanceledFromOpac($reserve_id,
160
                                                       $user->borrowernumber)) {
161
        return $c->$cb({error => "Hold is already in transfer or waiting and "
162
                                ."cannot be cancelled by patron."}, 403);
163
    }
164
156
    C4::Reserves::CancelReserve({ reserve_id => $reserve_id });
165
    C4::Reserves::CancelReserve({ reserve_id => $reserve_id });
157
166
158
    return $c->$cb({}, 200);
167
    return $c->$cb({}, 200);
(-)a/api/v1/swagger/paths/holds.json (+8 lines)
Lines 288-293 Link Here
288
            "type": "object"
288
            "type": "object"
289
          }
289
          }
290
        },
290
        },
291
        "403": {
292
          "description": "Cancellation forbidden",
293
          "schema": {
294
            "$ref": "../definitions.json#/error"
295
          }
296
        },
291
        "404": {
297
        "404": {
292
          "description": "Hold not found",
298
          "description": "Hold not found",
293
          "schema": {
299
          "schema": {
Lines 296-301 Link Here
296
        }
302
        }
297
      },
303
      },
298
      "x-koha-authorization": {
304
      "x-koha-authorization": {
305
        "allow-owner": true,
306
        "allow-guarantor": true,
299
        "permissions": {
307
        "permissions": {
300
          "reserveforothers": "1"
308
          "reserveforothers": "1"
301
        }
309
        }
(-)a/t/db_dependent/api/v1/holds.t (-3 / +18 lines)
Lines 180-186 subtest "Test endpoints without permission" => sub { Link Here
180
      ->status_is(403);
180
      ->status_is(403);
181
};
181
};
182
subtest "Test endpoints without permission, but accessing own object" => sub {
182
subtest "Test endpoints without permission, but accessing own object" => sub {
183
    plan tests => 15;
183
    plan tests => 21;
184
185
    my $reserve_id3 = C4::Reserves::AddReserve($branchcode, $nopermission->{'borrowernumber'},
186
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber, 'W');
187
    # try to delete my own hold while it's waiting; an error should occur
188
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id3" => json => $put_data);
189
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
190
    $t->request_ok($tx)
191
      ->status_is(403)
192
      ->json_is('/error', 'Hold is already in transfer or waiting and cannot be cancelled by patron.');
193
    # reset the hold's found status; after that, cancellation should work
194
    Koha::Holds->find($reserve_id3)->found('')->store;
195
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id3" => json => $put_data);
196
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
197
    $t->request_ok($tx)
198
      ->status_is(200);
199
    is(Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} }), undef, "Hold deleted.");
184
200
185
    my $borrno_tmp = $post_data->{'borrowernumber'};
201
    my $borrno_tmp = $post_data->{'borrowernumber'};
186
    $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'};
202
    $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'};
Lines 201-207 subtest "Test endpoints without permission, but accessing own object" => sub { Link Here
201
      ->json_is('/0/expirationdate', $expirationdate)
217
      ->json_is('/0/expirationdate', $expirationdate)
202
      ->json_is('/0/branchcode', $branchcode);
218
      ->json_is('/0/branchcode', $branchcode);
203
219
204
    my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id;
220
    $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id;
205
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data);
221
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data);
206
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
222
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
207
    $t->request_ok($tx) # create hold to myself
223
    $t->request_ok($tx) # create hold to myself
208
- 

Return to bug 17565