View | Details | Raw Unified | Return to bug 23634
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons.pm (+9 lines)
Lines 214-219 sub update { Link Here
214
     }
214
     }
215
215
216
    return try {
216
    return try {
217
        my $body = $c->validation->param('body');
218
        my $user = $c->stash('koha.user');
219
220
        if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) {
221
            return $c->render(
222
                status  => 403,
223
                openapi => { error => "Not enough privileges to change a superlibrarian's email" }
224
            ) if $body->{email} ne $patron->email ;
225
        }
217
226
218
        $patron->set_from_api($c->validation->param('body'))->store;
227
        $patron->set_from_api($c->validation->param('body'))->store;
219
        $patron->discard_changes;
228
        $patron->discard_changes;
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +18 lines)
Lines 222-235 subtest 'update() tests' => sub { Link Here
222
    $schema->storage->txn_rollback;
222
    $schema->storage->txn_rollback;
223
223
224
    subtest 'librarian access tests' => sub {
224
    subtest 'librarian access tests' => sub {
225
        plan tests => 22;
225
        plan tests => 25;
226
226
227
        $schema->storage->txn_begin;
227
        $schema->storage->txn_begin;
228
228
229
        my $authorized_patron = $builder->build_object(
229
        my $authorized_patron = $builder->build_object(
230
            {
230
            {
231
                class => 'Koha::Patrons',
231
                class => 'Koha::Patrons',
232
                value => { flags => 2**4 } # borrowers flag = 4
232
                value => { flags => 1 }
233
            }
233
            }
234
        );
234
        );
235
        my $password = 'thePassword123';
235
        my $password = 'thePassword123';
Lines 324-329 subtest 'update() tests' => sub { Link Here
324
        is(Koha::Patrons->find( $patron_2->id )->cardnumber,
324
        is(Koha::Patrons->find( $patron_2->id )->cardnumber,
325
           $newpatron->{ cardnumber }, 'Patron is really updated!');
325
           $newpatron->{ cardnumber }, 'Patron is really updated!');
326
326
327
        my $superlibrarian = $builder->build_object(
328
            {
329
                class => 'Koha::Patrons',
330
                value => { flags => 1 }
331
            }
332
        );
333
334
        $newpatron->{cardnumber} = $superlibrarian->cardnumber;
335
        $newpatron->{userid}     = $superlibrarian->userid;
336
        $newpatron->{email}      = 'nosense@no.no';
337
338
        $authorized_patron->flags( 2**4 )->store; # borrowers flag = 4
339
        $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
340
          ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
341
          ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } );
342
327
        $schema->storage->txn_rollback;
343
        $schema->storage->txn_rollback;
328
    };
344
    };
329
};
345
};
330
- 

Return to bug 23634