From f52e912ba335f8accb7c467a563872c91365f1ec Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Tue, 29 Jan 2019 11:29:06 -0300 Subject: [PATCH] Bug 22227: Make GET /cities staff only This patch removes the possibility to access the city objects without privileged access (minimum permissions == catalogue). It does so by adding the required permissions to the spec. The tests are adjusted. To test: - Apply this patch - Run: $ kshell k$ prove t/db_dependent/api/v1/cities.t => SUCCESS: Tests pass! - Sign off :-D Signed-off-by: Martin Renvoize --- api/v1/swagger/paths/cities.json | 10 ++++++++++ t/db_dependent/api/v1/cities.t | 5 ++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/api/v1/swagger/paths/cities.json b/api/v1/swagger/paths/cities.json index 96bbe55d28..5779a48651 100644 --- a/api/v1/swagger/paths/cities.json +++ b/api/v1/swagger/paths/cities.json @@ -60,6 +60,11 @@ "$ref": "../definitions.json#/error" } } + }, + "x-koha-authorization": { + "permissions": { + "catalogue": "1" + } } }, "post": { @@ -153,6 +158,11 @@ "$ref": "../definitions.json#/error" } } + }, + "x-koha-authorization": { + "permissions": { + "catalogue": "1" + } } }, "put": { diff --git a/t/db_dependent/api/v1/cities.t b/t/db_dependent/api/v1/cities.t index 765fdb71ad..ba64c29420 100644 --- a/t/db_dependent/api/v1/cities.t +++ b/t/db_dependent/api/v1/cities.t @@ -45,8 +45,7 @@ subtest 'list() tests' => sub { $schema->storage->txn_begin; Koha::Cities->search->delete; - my ( $borrowernumber, $session_id ) = - create_user_and_session( { authorized => 0 } ); + my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 }); ## Authorized user tests # No cities, so empty array should be returned @@ -116,7 +115,7 @@ subtest 'get() tests' => sub { $schema->storage->txn_begin; my $city = $builder->build_object({ class => 'Koha::Cities' }); - my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 0 }); + my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 }); my $tx = $t->ua->build_tx( GET => "/api/v1/cities/" . $city->id ); $tx->req->cookies({ name => 'CGISESSID', value => $session_id }); -- 2.20.1