Currently there's no check on permissions to see the requested patron, besides generic spec permissions check.
Created attachment 127757 [details] [review] Bug 29508: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 127758 [details] [review] Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited This patch makes the route return 404 if the user is not allowed to see the requested patron information. To test: 1. Apply the regression tests 2. Run: $ kshell k$ prove t/db_dependent/api/v1/patrons.t => FAIL: The code doesn't respect limits 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 127770 [details] [review] Bug 29508: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 127771 [details] [review] Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited This patch makes the route return 404 if the user is not allowed to see the requested patron information. To test: 1. Apply the regression tests 2. Run: $ kshell k$ prove t/db_dependent/api/v1/patrons.t => FAIL: The code doesn't respect limits 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Great work going through all this Tomas! Works as expected, tests are thorough and passing. Signing off
Created attachment 128671 [details] [review] Bug 29508: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 128672 [details] [review] Bug 29508: Make GET /patrons/:patron_id use Koha::Patrons->search_limited This patch makes the route return 404 if the user is not allowed to see the requested patron information. To test: 1. Apply the regression tests 2. Run: $ kshell k$ prove t/db_dependent/api/v1/patrons.t => FAIL: The code doesn't respect limits 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to master for 22.05, thanks to everybody involved [U+1F984]
Pushed to 21.11.x for 21.11.02
Pushed to 21.05.x for 21.05.08
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.