Koha-community/Koha - Koha - Koha: The world's first free and open source library system

Commit Graph

Author	SHA1	Message	Date
Julian Maurice	96cc447045	Bug 25898: Prohibit indirect object notation Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	3 years ago
Jonathan Druart	638786e719	Bug 24663: Remove authnotrequired if set to 0 It defaults to 0 in get_template_and_user Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	4 years ago
Jonathan Druart	b990b953b3	Bug 21993: Display a user-friendly message when the CSRF token is wrong Instead of dying! Test plan: Assuming you have a patron with borrowernumber=51 and another one that can be deleted with borrowernumber=42 - authorities-home.pl * Delete an authority record * hit /cgi-bin/koha/authorities/authorities-home.pl?op=delete - basket/sendbasket.pl * Send a basket to someone * hit /cgi-bin/koha/basket/sendbasket.pl?email_add=1 - members/apikeys.pl * Generate and delete an API key for a patron * hit /cgi-bin/koha/members/apikeys.pl?patron_id=51&op=delete - members/deletemem.pl * Delete a patron * hit /cgi-bin/koha/members/deletemem.pl?member=42&op=delete_confirmed - members/mancredit.pl * Add a manual credit * hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=51&add=1 - members/maninvoice.pl * Add a manual invoice * hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=51&add=1 - members/member-flags.pl * Change permissions for a patron * hit /cgi-bin/koha/members/member-flags.pl?member=51&newflags=1 - members/member-password.pl * Change the password for a patron (from the staff interface) * hit /cgi-bin/koha/members/member-password.pl?member=51&newpassword=aA1 - members/memberentry.pl * Edit some patron's info * hit /cgi-bin/koha/members/memberentry.pl?borrowernumber=51&op=save - members/paycollect.pl * Pay an individual fine * hit something like /cgi-bin/koha/members/paycollect.pl?borrowernumber=51&pay_individual=1&accounttype=L&amount=1.00&amountoutstanding=1.00&accountlines_id=157&paid=1 You may need to edit some values - tools/import_borrowers.pl * Import some patrons * hit /cgi-bin/koha/tools/import_borrowers.pl?uploadborrowers=1 - tools/picture-upload.pl * Upload an image for a patron * You will need to edit the html content hit Home › Tools › Upload patron images then locate the csrf_token input and modify its value Note for QA: - Opac is not done as blocking_errors.inc does not exist for this interface - ill/ill-requests.pl I did not manage to replace this occurrence Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>	5 years ago
Tomás Cohen Arazi	5cf8bbfb7a	Bug 20624: Make staff client respect RESTOAuth2ClientCredentials This patch makes the staff client UI respect the RESTOAuth2ClientCredentials syspref. To test: - Make sure RESTOAuth2ClientCredentials is "Don't enable" - Go to a patron's detail page => SUCCESS: The 'More' dropdown doesn't show the API keys management link. - Enable RESTOAuth2ClientCredentials - Reload => SUCCESS: The 'More' dropdown shows the API keys management link - Click on the API keys management link => SUCCESS: You can edit the api keys - Disable the syspref - Reload => SUCCESS: You are presented an error 400 page. - Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Jonathan Druart	2a8c3fad0a	Bug 20568: fix shebang Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Jonathan Druart	d2454d6868	Bug 20568: Fix bad resolution conflict with bug 18403 borrowers module permission has now several subpermissions Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Tomás Cohen Arazi	45841d9ec7	Bug 20568: CSRF protection Edit: fix warning introduced by this patch Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Tomás Cohen Arazi	28a750fb76	Bug 20568: (QA follow-up) Get rid of the id column Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Tomás Cohen Arazi	b67e88f429	Bug 20568: Move value => client_id + secret This patch addresses the request from Julian that api keys are expected to be client id/secret pairs. It does so by - Adding 'client_id' and 'secret' columns - Removing 'value' Tests got adjusted and so controller scripts and templates. Both libs and tests changes have been squashed. This ones remain in order to keep Owen's attribution on the template changes and avoid rebase conflicts. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Tomás Cohen Arazi	05101f0afa	Bug 20568: Add mandatory description field for api keys This patch changes the table structure adding fields usually found on this kind of api management pages. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Julian Maurice	3aa102d0c3	Bug 20568: API keys management in interface This introduces the concept of API keys for use in the new REST API. A key is a string of 32 alphanumerical characters (32 is purely arbitrary, it can be changed easily). A user can have multiple keys (unlimited at the moment) Keys can be generated automatically, and then we have the possibility to delete or revoke each one individually. Test plan: 1/ Go to staff interface 2/ Go to a borrower page 3/ In toolbar, click on More -> Manage API keys 4/ Click on "Generate new key" multiple times, check that they are correctly displayed under the button, and they are active by default 5/ Revoke some keys, check that they are not active anymore 6/ Delete some keys, check that they disappear from table 7/ Go to opac interface, log in 8/ In your user account pages, you now have a new tab to the left "your API keys". Click on it. 9/ Repeat steps 4-6 Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	9 years ago

11 Commits (4d011bd9983926488f783730ca43e98e6e07dabe)