| Summary: | Getting patrons/{patron_id} via REST API requires edit_borrowers permission | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Emmi Takkinen <emmi.takkinen> |
| Component: | REST API | Assignee: | Matt Blenkinsop <matt.blenkinsop> |
| Status: | RESOLVED DUPLICATE | QA Contact: | Kyle M Hall (khall) <kyle> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dcook, f.demians, kyle, martin.renvoize, matt.blenkinsop, tomascohen |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29509 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 32502: Api call to patrons/{patron_id} permission change
Bug 32502: Api call to patrons/{patron_id} permission change Bug 32502: Api call to patrons/{patron_id} permission change |
||
Created attachment 144783 [details] [review] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested Created attachment 144845 [details] [review] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested Signed-off-by: Frédéric Demians <f.demians@tamil.fr> Created attachment 146512 [details] [review] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested Signed-off-by: Frédéric Demians <f.demians@tamil.fr> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> I'm not sure I agree with this patch.
Our permissions schema is obfuscated, but view_borrower_infos_from_any_libraries goes too far as well. We really need something like 'view_borrowers', and let Koha::Patrons->search_limited take care of which patrons can actually be seen.
Something like:
my $patron = Koha::Patrons->search_limited;
unless ($patron) {
# return 404
}
return $patron->to_api;
(In reply to Tomás Cohen Arazi from comment #4) > I'm not sure I agree with this patch. > > Our permissions schema is obfuscated, but > view_borrower_infos_from_any_libraries goes too far as well. We really need > something like 'view_borrowers', and let Koha::Patrons->search_limited take > care of which patrons can actually be seen. +1 We have 'list_borrowers' now, that's the appropriate permission here |
Staff without edit_borrowers permission can see patrons info in detail.pl or returns.pl, but not via REST API call GET patrons/{patron_id}. We should use permission view_borrower_infos_from_any_libraries here instead of edit_borrowers.