View | Details | Raw Unified | Return to bug 22061
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (+14 lines)
Lines 57-64 sub under { Link Here
57
    my $c = shift->openapi->valid_input or return;;
57
    my $c = shift->openapi->valid_input or return;;
58
58
59
    my $status = 0;
59
    my $status = 0;
60
60
    try {
61
    try {
61
62
63
        # /api/v1/{namespace}
64
        my $namespace = $c->req->url->to_abs->path->[2];
65
66
        if ( $namespace eq 'public'
67
            and !C4::Context->preference('RESTPublicAPI') )
68
        {
69
            Koha::Exceptions::Authorization->throw(
70
                "Configuration prevents the usage of this endpoint by unprivileged users");
71
        }
72
62
        $status = authenticate_api_request($c);
73
        $status = authenticate_api_request($c);
63
74
64
    } catch {
75
    } catch {
Lines 89-94 sub under { Link Here
89
                required_permissions => $_->required_permissions,
100
                required_permissions => $_->required_permissions,
90
            });
101
            });
91
        }
102
        }
103
        elsif ($_->isa('Koha::Exceptions::Authorization')) {
104
            return $c->render(status => 403, json => { error => $_->error });
105
        }
92
        elsif ($_->isa('Koha::Exceptions')) {
106
        elsif ($_->isa('Koha::Exceptions')) {
93
            return $c->render(status => 500, json => { error => $_->error });
107
            return $c->render(status => 500, json => { error => $_->error });
94
        }
108
        }
(-)a/t/db_dependent/api/v1/auth.t (-2 / +16 lines)
Lines 39-50 my $t = Test::Mojo->new('Koha::REST::V1'); Link Here
39
my $tx;
39
my $tx;
40
40
41
subtest 'under() tests' => sub {
41
subtest 'under() tests' => sub {
42
    plan tests => 15;
42
43
    plan tests => 20;
43
44
44
    $schema->storage->txn_begin;
45
    $schema->storage->txn_begin;
45
46
46
    my ($borrowernumber, $session_id) = create_user_and_session();
47
    my ($borrowernumber, $session_id) = create_user_and_session();
47
48
49
    # disable the /public namespace
50
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 0 );
51
    $tx = $t->ua->build_tx( POST => "/api/v1/public/patrons/$borrowernumber/password" );
52
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
53
    $t->request_ok($tx)
54
      ->status_is(403)
55
      ->json_is('/error', 'Configuration prevents the usage of this endpoint by unprivileged users');
56
57
    # enable the /public namespace
58
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
59
    $tx = $t->ua->build_tx( GET => "/api/v1/public/patrons/$borrowernumber/password" );
60
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
61
    $t->request_ok($tx)->status_is(404);
62
48
    # 401 (no authentication)
63
    # 401 (no authentication)
49
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
64
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
50
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
65
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
51
- 

Return to bug 22061