[Bug 25411] New: Plugin routes cannot have annonymous access
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Bug ID: 25411 Summary: Plugin routes cannot have annonymous access Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com This is a consequence of a big change introduced by bug 25045 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |tomascohen@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com --- Comment #1 from Tomás Cohen Arazi <tomascohen@gmail.com> --- *** Bug 25484 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #2 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 104968 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104968&action=edit Bug 25411: Regression tests This patch adds tests the new RESTPublicAnonymousRequests syspref doesn't apply to routes added by plugins. It is up to the plugin developer to handle those conditions. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #3 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 104969 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104969&action=edit Bug 25411: Add special handling for public plugin routes This patch implements the required logic in the API code so plugins are not affected by the new RESTPublicAnonymousRequests system preference. It is up to the plugin develpers to handle this To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! Yay! Not bad for a friday evening! 5. Sign off :-D Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com, | |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_20_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #104968|0 |1 is obsolete| | --- Comment #4 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 104978 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104978&action=edit Bug 25411: Regression tests This patch adds tests the new RESTPublicAnonymousRequests syspref doesn't apply to routes added by plugins. It is up to the plugin developer to handle those conditions. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #104969|0 |1 is obsolete| | --- Comment #5 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 104979 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104979&action=edit Bug 25411: Add special handling for public plugin routes This patch implements the required logic in the API code so plugins are not affected by the new RESTPublicAnonymousRequests system preference. It is up to the plugin develpers to handle this To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! Yay! Not bad for a friday evening! 5. Sign off :-D Sponsored-by: ByWater Solutions Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net Status|Needs Signoff |Failed QA --- Comment #6 from Victor Grousset/tuxayo <victor@tuxayo.net> --- It works, and hooray for tests first :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #7 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Whoops, wrong status. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Plugin routes cannot have |Plugin routes cannot have |annonymous access |anonymous access CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|tomascohen@gmail.com |jonathan.druart@bugs.koha-c | |ommunity.org CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #104978|0 |1 is obsolete| | Attachment #104979|0 |1 is obsolete| | --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 105155 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=105155&action=edit Bug 25411: Regression tests This patch adds tests the new RESTPublicAnonymousRequests syspref doesn't apply to routes added by plugins. It is up to the plugin developer to handle those conditions. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #9 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 105156 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=105156&action=edit Bug 25411: Add special handling for public plugin routes This patch implements the required logic in the API code so plugins are not affected by the new RESTPublicAnonymousRequests system preference. It is up to the plugin develpers to handle this To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! Yay! Not bad for a friday evening! 5. Sign off :-D Sponsored-by: ByWater Solutions Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #10 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 105157 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=105157&action=edit Bug 25411: Group conditions in if elsif Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |jonathan.druart@bugs.koha-c | |ommunity.org Patch complexity|--- |Small patch Assignee|jonathan.druart@bugs.koha-c |tomascohen@gmail.com |ommunity.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #11 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Jonathan Druart from comment #10)
Created attachment 105157 [details] [review] Bug 25411: Group conditions in if elsif
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Thanks, my initial implementation was a bit more complex (it involved forcing a new layout on the plugins side) and when I rolled it back I forgot this). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- I've only skimmed the code, but it looks good at a glance. For a second, I thought it was making all plugin API routes public, but then I noticed that's only if they don't have 'x-koha-authorization' defined. I wonder if there's anything we need or can do in the API documentation to make it more obvious what (plugin) routes require auth and which don't? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #13 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #12)
I've only skimmed the code, but it looks good at a glance.
For a second, I thought it was making all plugin API routes public, but then I noticed that's only if they don't have 'x-koha-authorization' defined.
I wonder if there's anything we need or can do in the API documentation to make it more obvious what (plugin) routes require auth and which don't?
Just a general question. Not directly related to this bug report per se... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |20.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice work everyone! Pushed to master for 20.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_20_05_candidate | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aleisha@catalyst.net.nz --- Comment #15 from Aleisha Amohia <aleisha@catalyst.net.nz> --- missing dependencies, not backported to 19.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #16 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 106084 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=106084&action=edit [19.11.x] Bug 25411: Regression tests This patch adds tests the new RESTPublicAnonymousRequests syspref doesn't apply to routes added by plugins. It is up to the plugin developer to handle those conditions. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #17 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 106085 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=106085&action=edit [19.11.x] Bug 25411: Add special handling for public plugin routes This patch implements the required logic in the API code so plugins are not affected by the new RESTPublicAnonymousRequests system preference. It is up to the plugin develpers to handle this To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t => FAIL: Notice the tests fail 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! Yay! Not bad for a friday evening! 5. Sign off :-D Sponsored-by: ByWater Solutions Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |24003 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24003 [Bug 24003] REST API should set C4::Context->userenv -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |25327 --- Comment #18 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Aleisha, only the [19.11.x] patches here. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25327 [Bug 25327] Cannot access API spec -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|20.05.00 |20.05.00, 19.11.07 released in| | --- Comment #19 from Aleisha Amohia <aleisha@catalyst.net.nz> --- backported to 19.11.x for 19.11.07 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 --- Comment #20 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Missing dependencies for 19.05.x, can't backport. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25411 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |26322 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org