In the API swagger definition for validateUserAndPassword: 1184 x-koha-authorization: 1185 permissions: 1186 borrowers: "1" Requiring the top level permission is more than should be needed. It shouldn't need delete_borrowers or send_messages_to_borrowers. We should add a new sub-permission for borrowers like 'api_validate_password'
I agree. I have patches on bug 36561. Can you take a look there? I think Katrin marked it as Failed QA from Passed QA, although I don't know why. *** This bug has been marked as a duplicate of bug 36561 ***
Created attachment 184588 [details] [review] Bug 40441: Add new permission api_validate_password This patch adds a new permission 'api_validate_password' that will be used to control access to the /auth/password/validation endpoint. The permission is added to: - userpermissions.sql for new installations - permissions.inc for display in the staff interface - atomic update script for existing installations Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 184589 [details] [review] Bug 40441: Make /auth/password/validation use new permission This patch updates the /auth/password/validation endpoint to use the new api_validate_password permission instead of the generic borrowers permission. This provides more granular control over who can use the password validation API endpoint. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(In reply to David Cook from comment #1) > I agree. I have patches on bug 36561. Can you take a look there? > > I think Katrin marked it as Failed QA from Passed QA, although I don't know > why. > > *** This bug has been marked as a duplicate of bug 36561 *** Oops. Will do. Do you think we could go with my permission name/description? I believe is more accurate on the scope.