Summary: | Make /patrons/:patron_id/account privileged user only | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Component: | REST API | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | normal | ||
Priority: | P5 - low | CC: | fridolin.somers, josef.moravec, lucas, m.de.rooy |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
19.11.00,19.05.05
|
|
Circulation function: | |||
Bug Depends on: | 20942 | ||
Bug Blocks: | 22218 | ||
Attachments: |
Bug 23607: Make /patrons/:patron_id/account staff only
Bug 23607: Make /patrons/:patron_id/account staff only Bug 23607: Make /patrons/:patron_id/account staff only |
Description
Tomás Cohen Arazi (tcohen)
2019-09-13 13:45:21 UTC
Created attachment 92802 [details] [review] Bug 23607: Make /patrons/:patron_id/account staff only Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> What is the test plan for this? Created attachment 92918 [details] [review] Bug 23607: Make /patrons/:patron_id/account staff only Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Tested with this plan: 1) remove two lines from api/v1/swagger/paths/patrons_account.json as in patch 2) prove t/db_dependent/api/v1/patrons_accounts.t --> it should fails with http status 403 3) git checkout -- api/v1/swagger/paths/patrons_account.json 4) apply patch 5) prove t/db_dependent/api/v1/patrons_accounts.t --> now it return green Created attachment 93184 [details] [review] Bug 23607: Make /patrons/:patron_id/account staff only Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Side note: staff only in the title is a bit confusing, since you can still see it via opac if your user has these two permissions. Nice work! Pushed to master for 19.11.00 Pushed to 19.05.x for 19.05.05 backported to 18.11.x for 18.11.11 |