Summary: | GET /patrons/:patron_id should use Koha::Patrons->search_limited | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Component: | REST API | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Status: | CLOSED FIXED | QA Contact: | |
Severity: | minor | ||
Priority: | P5 - low | CC: | 1joynelson, andrew, fridolin.somers, jonathan.druart, kyle, lucas, m.de.rooy, martin.renvoize, nick, victor |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
22.05.00,21.11.02,21.05.08
|
|
Circulation function: | |||
Bug Depends on: | 29506 | ||
Bug Blocks: | 29510 | ||
Attachments: |
Bug 29508: Regression tests
Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited Bug 29508: Regression tests Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited Bug 29508: Regression tests Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited |
Description
Tomás Cohen Arazi (tcohen)
2021-11-17 19:27:22 UTC
Created attachment 127757 [details] [review] Bug 29508: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 127758 [details] [review] Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited This patch makes the route return 404 if the user is not allowed to see the requested patron information. To test: 1. Apply the regression tests 2. Run: $ kshell k$ prove t/db_dependent/api/v1/patrons.t => FAIL: The code doesn't respect limits 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 127770 [details] [review] Bug 29508: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 127771 [details] [review] Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited This patch makes the route return 404 if the user is not allowed to see the requested patron information. To test: 1. Apply the regression tests 2. Run: $ kshell k$ prove t/db_dependent/api/v1/patrons.t => FAIL: The code doesn't respect limits 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Great work going through all this Tomas! Works as expected, tests are thorough and passing. Signing off Created attachment 128671 [details] [review] Bug 29508: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 128672 [details] [review] Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited This patch makes the route return 404 if the user is not allowed to see the requested patron information. To test: 1. Apply the regression tests 2. Run: $ kshell k$ prove t/db_dependent/api/v1/patrons.t => FAIL: The code doesn't respect limits 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to master for 22.05, thanks to everybody involved [U+1F984] Pushed to 21.11.x for 21.11.02 Pushed to 21.05.x for 21.05.08 Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed. |