@@ -, +, @@ check_cookie_auth --- C4/Auth.pm | 8 ++++++-- Koha/REST/V1/Auth.pm | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -1606,7 +1606,11 @@ sub check_api_auth { ($status, $sessionId) = check_api_auth($cookie, $userflags); Given a CGISESSID cookie set during a previous login to Koha, determine -if the user has the privileges specified by C<$userflags>. +if the user has the privileges specified by C<$userflags>. C<$userflags> +is passed unaltered into C and as such accepts all options +avaiable to that routine with the one caveat that C will +also allow 'undef' to be passed and in such a case the permissions check +will be skipped altogether. C is meant for authenticating special services such as tools/upload-file.pl that are invoked by other pages that @@ -1701,7 +1705,7 @@ sub check_cookie_auth { return ( "expired", undef ); } else { $session->param( 'lasttime', time() ); - my $flags = haspermission( $userid, $flagsrequired ); + my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; if ($flags) { return ( "ok", $sessionID ); } else { --- a/Koha/REST/V1/Auth.pm +++ a/Koha/REST/V1/Auth.pm @@ -189,7 +189,7 @@ sub authenticate_api_request { # Manually pass the remote_address to check_auth_cookie my $remote_addr = $c->tx->remote_address; my ($status, $sessionID) = check_cookie_auth( - $cookie, '*', + $cookie, undef, { remote_addr => $remote_addr }); if ($status eq "ok") { my $session = get_session($sessionID); --