[Bug 34287] New: Patron's should not be able to ask for checkoutability for different patrons
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Bug ID: 34287 Summary: Patron's should not be able to ask for checkoutability for different patrons Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com CC: tomascohen@gmail.com Bug 30979 implemented an endpoint for checking availability for checking out an item, and the description explains it is for checking out themselves... but it allows asking for any patron's checkoutability. I open this bug to discuss that behvior. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |30979 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30979 [Bug 30979] Add ability for OPAC users to checkout to themselves -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I assume this is a public route? It does sound not quite right. Not sure what is returned, but could others learn about restrictions etc.? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #2 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Good catch.. I'm not sure I thought about that case.. there is already the staff version of this api endpoint for third party consumers so I think your right.. the public endpoint should be more locked down. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 --- Comment #3 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 155544 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=155544&action=edit Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |martin.renvoize@ptfs-europe |ity.org |.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Needs Signoff |Failed QA --- Comment #4 from Lucas Gass <lucas@bywatersolutions.com> --- Seems like a good fix except that unit tests seem to be failing now for t/db_dependent/api/v1/checkouts.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 155929 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=155929&action=edit Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #155544|0 |1 is obsolete| | --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 155930 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=155930&action=edit Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Reworked and unit tested -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Group|Koha security | Product|Koha security |Koha Component|Koha |REST API -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org