Main Koha release repository
https://koha-community.org
921e3ac50f
This patch limits the accessibility for "Manage API keys" section only to superlibrarians and the owner of that said API key account. The way it does it is by checking if user is superlibrarian or if logged-in user is the same as a patron id/borrower number is the same as logged-in user number both in template and apikeys.pl and making sure the link is inaccessible or redirects to the 403 page if user tries to go there directly. To reproduce: 1) create/pick existing patron, set Staff access, allows viewing of catalogue in staff interface (catalogue)" and "Add, modify and iew patron information (borrowers)" permissions on; 2) enable "RESTOAuth2ClientCredentials" in sysprefs; 3) login with that user into staff interface; 4) check any other patron, go to the "More"->"Manage API keys" and check that you can see, add delete their API keys; 5) apply patch; 6) with that same user try to access "Manage API keys" page again. Ensure that you can't access that page of other patrons but can access your own page and manage your own API keys. 7) log in with superlibrarian now and ensure that you can access every "Manage API keys" page of every patron and apply changes there. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> |
||
|---|---|---|
| acqui | ||
| admin | ||
| api | ||
| authorities | ||
| basket | ||
| bin | ||
| C4 | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| errors | ||
| etc | ||
| ill | ||
| installer | ||
| Koha | ||
| koha-tmpl | ||
| labels | ||
| lib/CGI/Session/Serialize | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| pos | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| skel | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| tmp/modified_authorities | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .editorconfig | ||
| .eslintrc.json | ||
| .gitignore | ||
| .htaccess | ||
| .mailmap | ||
| .perlcriticrc | ||
| .scss-lint.yml | ||
| about.pl | ||
| app.psgi | ||
| changelanguage.pl | ||
| cpanfile | ||
| fix-perl-path.PL | ||
| gulpfile.js | ||
| help.pl | ||
| INSTALL | ||
| Koha.pm | ||
| koha_perl_deps.pl | ||
| kohaversion.pl | ||
| LICENSE | ||
| mainpage.pl | ||
| Makefile.PL | ||
| MANIFEST.SKIP | ||
| package.json | ||
| README | ||
| README.md | ||
| README.robots | ||
| rewrite-config.PL | ||
| yarn.lock | ||
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
