Staff without edit_borrowers permission can see patrons info in detail.pl or returns.pl, but not via REST API call GET patrons/{patron_id}. We should use permission view_borrower_infos_from_any_libraries here instead of edit_borrowers.
Created attachment 144783 [details] [review] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested
Created attachment 144845 [details] [review] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Created attachment 146512 [details] [review] Bug 32502: Api call to patrons/{patron_id} permission change The API permissions for GET patrons/{patron_id} required staff to have edit_borrowers permission rather than view_borrower_infos_from_any_libraries. This has now been changed to allow staff to access patrons through the API. Test plan: 1) From a staff account that does not have edit_borrowers permission, make a request to patrons/{patron_id} 2) The request should be rejected 3) Apply patch 4) Repeat the request 5) The request should return the data for the patron requested Signed-off-by: Frédéric Demians <f.demians@tamil.fr> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
I'm not sure I agree with this patch. Our permissions schema is obfuscated, but view_borrower_infos_from_any_libraries goes too far as well. We really need something like 'view_borrowers', and let Koha::Patrons->search_limited take care of which patrons can actually be seen. Something like: my $patron = Koha::Patrons->search_limited; unless ($patron) { # return 404 } return $patron->to_api;
(In reply to Tomás Cohen Arazi from comment #4) > I'm not sure I agree with this patch. > > Our permissions schema is obfuscated, but > view_borrower_infos_from_any_libraries goes too far as well. We really need > something like 'view_borrowers', and let Koha::Patrons->search_limited take > care of which patrons can actually be seen. +1
We have 'list_borrowers' now, that's the appropriate permission here
Resolved by bug 30230 *** This bug has been marked as a duplicate of bug 30230 ***