[Bug 31555] New: Getting holds via REST API needs edit_borrowers permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Bug ID: 31555 Summary: Getting holds via REST API needs edit_borrowers permission Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: johanna.raisa@koha-suomi.fi CC: tomascohen@gmail.com Permissions on holds GET endpoint and request.pl are different. Staff member can see holds with place_holds permission and but via REST API it is blocked. Also a staff member can see and modify holds on patron's page without edit_borrowers permission. The GET endpoint should use place_holds permission to be more consistent. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |johanna.raisa@koha-suomi.fi |ity.org | Status|NEW |Needs Signoff --- Comment #1 from Johanna Räisä <johanna.raisa@koha-suomi.fi> --- Created attachment 140611 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=140611&action=edit Bug 31555: change holds GET permission to place_holds This patch changes holds' GET REST API endpoint permission to place_holds to match with request.pl Test plan: 1) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #140611|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 140630 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=140630&action=edit Bug 31555: change holds GET permission to place_holds This patch changes holds' GET REST API endpoint permission to place_holds to match with request.pl Test plan: 1) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |kyle@bywatersolutions.com CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #140630|0 |1 is obsolete| | --- Comment #3 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 141503 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=141503&action=edit Bug 31555: change holds GET permission to place_holds This patch changes holds' GET REST API endpoint permission to place_holds to match with request.pl Test plan: 1) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Our permissions need a revamp (i.e. we should have individual permissions for each hold action). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |22.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 22.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31555 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |RESOLVED CC| |lucas@bywatersolutions.com Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org