Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 34287: Add check on public availability endpoint

Browse source 
A quick check for patron equals current user in the public availability
endpoint.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This commit is contained in:
Martin Renvoize 2023-09-12 10:25:36 +01:00 committed by Tomas Cohen Arazi
parent bc2fa03d5c
commit a5f3815c65
Signed by: tomascohen
GPG key ID: 0A272EA1B2F3C15F
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
api/v1/swagger/paths/checkouts.yaml
View file

@ -411,3 +411,5 @@
description: Under maintenance
schema:
$ref: "../swagger.yaml#/definitions/error"
x-koha-authorization:
allow-owner: true

5
t/db_dependent/api/v1/checkouts.t
View file

@ -342,9 +342,8 @@ subtest 'get_availability' => sub {
$t->get_ok("/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")->status_is(401);
# Only allow availability lookup for self
$t->get_ok(
"//$userid:$password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id"
)->status_is(403);
$t->get_ok("//$userid:$password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")
->status_is(403);
# All ok
$t->get_ok(