Summary: | /auth/password/validation ( validateUserAndPassword ) requires too much permissions | ||
---|---|---|---|
Product: | Koha | Reporter: | Lucas Gass (lukeg) <lucas> |
Component: | REST API | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Status: | RESOLVED DUPLICATE | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Attachments: |
Bug 40441: Add new permission api_validate_password
Bug 40441: Make /auth/password/validation use new permission |
Description
Lucas Gass (lukeg)
2025-07-17 21:03:06 UTC
I agree. I have patches on bug 36561. Can you take a look there? I think Katrin marked it as Failed QA from Passed QA, although I don't know why. *** This bug has been marked as a duplicate of bug 36561 *** Created attachment 184588 [details] [review] Bug 40441: Add new permission api_validate_password This patch adds a new permission 'api_validate_password' that will be used to control access to the /auth/password/validation endpoint. The permission is added to: - userpermissions.sql for new installations - permissions.inc for display in the staff interface - atomic update script for existing installations Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 184589 [details] [review] Bug 40441: Make /auth/password/validation use new permission This patch updates the /auth/password/validation endpoint to use the new api_validate_password permission instead of the generic borrowers permission. This provides more granular control over who can use the password validation API endpoint. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> (In reply to David Cook from comment #1) > I agree. I have patches on bug 36561. Can you take a look there? > > I think Katrin marked it as Failed QA from Passed QA, although I don't know > why. > > *** This bug has been marked as a duplicate of bug 36561 *** Oops. Will do. Do you think we could go with my permission name/description? I believe is more accurate on the scope. |