From 636f04fae95ce4e1c7f05b0c0bc1ff7965679ca2 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Tue, 19 Nov 2019 13:57:51 +0000 Subject: [PATCH] Bug 24067: Use check_resource_ownership in authorization To test: 1. prove t/db_dependent/api/v1/patrons_password.t 2. Observe failure (yes, really a failure - tests will pass in later test) Looks like you failed 7 tests of 15. t/db_dependent/api/v1/patrons_password.t .. 2/2 Failed test 'set_public() (unprivileged user tests)' at t/db_dependent/api/v1/patrons_password.t line 235. Looks like you failed 1 test of 2. t/db_dependent/api/v1/patrons_password.t .. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/2 subtests Sponsored-by: Koha-Suomi Oy --- Koha/REST/V1/Auth.pm | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index ef4a6ed9e6..6e99c13359 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -278,9 +278,9 @@ sub validate_query_parameters { =head3 allow_owner -Allows access to object for its owner. +Allows access to resource for its owner. -There are endpoints that should allow access for the object owner even if they +There are endpoints that should allow access for the resource owner even if they do not have the required permission, e.g. access an own reserve. This can be achieved by defining the operation as follows: @@ -303,12 +303,12 @@ sub allow_owner { return unless $authorization->{'allow-owner'}; - return check_object_ownership($c, $user) if $user and $c; + return check_resource_ownership($c, $user) if $user and $c; } =head3 allow_guarantor -Same as "allow_owner", but checks if the object is owned by one of C<$user>'s +Same as "allow_owner", but checks if the resource is owned by one of C<$user>'s guarantees. =cut @@ -322,7 +322,7 @@ sub allow_guarantor { my $guarantees = $user->guarantee_relationships->guarantees->as_list; foreach my $guarantee (@{$guarantees}) { - return 1 if check_object_ownership($c, $guarantee); + return 1 if check_resource_ownership($c, $guarantee); } } -- 2.17.1