Bug 16815 - API routes to list, create, update, delete holds need permissions
Summary: API routes to list, create, update, delete holds need permissions
Status: RESOLVED DUPLICATE of bug 14868
Alias: None
Product: Koha
Classification: Unclassified
Component: Hold requests (show other bugs)
Version: 16.05
Hardware: All All
: P5 - low critical (vote)
Assignee: Julian Maurice
QA Contact: Testopia
Depends on: 13903
  Show dependency treegraph
Reported: 2016-06-27 14:15 UTC by Kyle M Hall
Modified: 2016-12-14 14:05 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2016-06-27 14:15:15 UTC
The REST api for holds CRUD should require hold permissions! I think it needs reserveforothers and it's subpermissions implemented.
Comment 1 Lari Taskula 2016-06-30 15:05:58 UTC
This issue is fixed in Bug 14868, however it does not directly duplicate this bug since Bug 14868 (Swagger2-driven permission checking) is last of three changes that modify the Swagger-specification aiming towards more split specification including the introduction of permissions in Path-object. Here are short descriptions for the three Bugs:

1. Bug 16212 adds a "minifier"-script to Swagger that fixes problems the current way of splitting swagger.json in master has caused; the problem is that splitting the "definitions" to $ref: definitions/index.json is not allowed (same with Paths-object) in Swagger. If we use a script to resolve the references in swagger.json, it becomes valid. You can see this problem if you try to validate our master Swagger specification with online.swagger.io validator.
2. Bug 16699 (depends on 16212) splits swagger.json further than what has already been done, and uses the minifier to make this type of split allowed.
3. Bug 14868 fixes the issue reported in this bug, but is dependant on Bug 16699.

It would be cool if someone took a look at them. I'm adding it as See Also. :)
Comment 2 Tomás Cohen Arazi 2016-08-23 14:15:10 UTC
I mark it for 16.05 as the REST api has been enabled in that branch's latest release. And the proper solution for master what Lari mentions: bug 14868.

I'll start working on it.
Comment 3 Tomás Cohen Arazi 2016-12-14 14:05:38 UTC

*** This bug has been marked as a duplicate of bug 14868 ***