[Koha-devel] REST API should not advertise required permissions

Hi all, I just noticed the following error while testing the REST API: {"error":"Authorization failure. Missing required permission(s).","required_permissions":{"borrowers":"1"}} It seems to me that we should just stop at "Authorization failure". While it might be helpful for a dev to know what the required permissions are, I think it would also be overly helpful for an attacker to know what permissions are required too, no? I suppose Koha is open source, so it wouldn't be hard for them to look them up anyway, but it just seems odd? David Cook Senior Software Engineer Prosentient Systems Suite 7.03 6a Glen St Milsons Point NSW 2061 Australia Office: 02 9212 0899 Online: 02 8005 0595