From 12fc4702dda1d414be087750377730cf39eda25d Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Tue, 19 Nov 2019 13:59:02 +0000 Subject: [PATCH] Bug 24067: Use owner_authorization in current public endpoints To test: 1. prove t/db_dependent/api/v1/patrons_password.t 2. Observe success 3. prove t/db_dependent/api/v1/patrons.t 4. Observe success Sponsored-by: Koha-Suomi Oy --- Koha/REST/V1/Patrons.pm | 15 +++++++++++++++ Koha/REST/V1/Patrons/Password.pm | 11 +++++++++++ 2 files changed, 26 insertions(+) diff --git a/Koha/REST/V1/Patrons.pm b/Koha/REST/V1/Patrons.pm index fb9e51f67a..5ad6f3d26f 100644 --- a/Koha/REST/V1/Patrons.pm +++ b/Koha/REST/V1/Patrons.pm @@ -465,6 +465,21 @@ sub _to_model { return $patron; } +sub owner_authorization { + my ($c, $method, $user, $auth_spec) = @_; + + if ($method eq 'guarantors_can_see_charges') { + my $patron_id = $c->match->stack->[-1]->{'patron_id'}; + return $user->borrowernumber == $patron_id ? 1 : 0; + } + elsif ($method eq 'guarantors_can_see_checkouts') { + my $patron_id = $c->match->stack->[-1]->{'patron_id'}; + return $user->borrowernumber == $patron_id ? 1 : 0; + } + + return 0; +} + =head2 Global variables =head3 $to_api_mapping diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm index e9d42d7fcb..e162611aa8 100644 --- a/Koha/REST/V1/Patrons/Password.pm +++ b/Koha/REST/V1/Patrons/Password.pm @@ -135,4 +135,15 @@ sub set_public { }; } +sub owner_authorization { + my ($c, $method, $user, $auth_spec) = @_; + + if ($method eq 'set_public') { + my $patron_id = $c->match->stack->[-1]->{'patron_id'}; + return $user->borrowernumber == $patron_id ? 1 : 0; + } + + return 0; +} + 1; -- 2.17.1