Summary: | Patron's should not be able to ask for checkoutability for different patrons | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Component: | REST API | Assignee: | Martin Renvoize (ashimema) <martin.renvoize> |
Status: | CLOSED FIXED | QA Contact: | Nick Clemens (kidclamp) <nick> |
Severity: | major | ||
Priority: | P5 - low | CC: | 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, kyle, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, nugged, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
23.11.00
|
|
Circulation function: | |||
Bug Depends on: | 30979 | ||
Bug Blocks: | |||
Attachments: |
Bug 34287: Add check on public availability endpoint
Bug 34287: Amend unit test Bug 34287: Add check on public availability endpoint Bug 34287: Amend unit test Bug 34287: Add check on public availability endpoint Bug 34287: Amend unit test Bug 34287: Add check on public availability endpoint |
Description
Tomás Cohen Arazi (tcohen)
2023-07-14 19:37:26 UTC
I assume this is a public route? It does sound not quite right. Not sure what is returned, but could others learn about restrictions etc.? Good catch.. I'm not sure I thought about that case.. there is already the staff version of this api endpoint for third party consumers so I think your right.. the public endpoint should be more locked down. Created attachment 155544 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. Seems like a good fix except that unit tests seem to be failing now for t/db_dependent/api/v1/checkouts.t Created attachment 155929 [details] [review] Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side. Created attachment 155930 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. Reworked and unit tested Hum, I am confused, didn't we have a test to ensure that all our routes had the "x-koha-authorization" entry? Created attachment 158043 [details] [review] Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 158044 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 158251 [details] [review] Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 158252 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to master for 23.11. Nice work everyone, thanks! Depends on Bug 30979 not in 23.05.x |