gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'new/security-release-19.11.10' into 19.11.x

This commit is contained in:
Aleisha Amohia 2020-09-22 10:19:14 +12:00
parent 1e487927fc 57bb4ee95e
commit 23b83e138c
2 changed files with 35 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Koha/REST/V1/Auth.pm
View File

@ -254,7 +254,7 @@ sub authenticate_api_request {
if ( !$authorization and
( $params->{is_public} and
( C4::Context->preference('RESTPublicAnonymousRequests') or
$user) ) or $params->{is_plugin} ) {
$user) or $params->{is_plugin} ) ) {
# We do not need any authorization
# Check the parameters
validate_query_parameters( $c, $spec );

40
t/db_dependent/Koha/REST/Plugin/PluginRoutes.t
View File

@ -37,8 +37,10 @@ BEGIN {
use Koha::Database;
use Koha::Plugins;
use t::lib::TestBuilder;
my $schema = Koha::Database->new->schema;
my $schema = Koha::Database->new->schema;
my $builder = t::lib::TestBuilder->new;
subtest 'Bad plugins tests' => sub {
@ -120,14 +122,16 @@ subtest 'Disabled plugins tests' => sub {
$schema->storage->txn_rollback;
};
subtest 'Anonymous access routes plugins tests' => sub {
subtest 'Permissions and access to plugin routes tests' => sub {
plan tests => 9;
plan tests => 16;
$schema->storage->txn_begin;
# enable plugins
t::lib::Mocks::mock_config( 'enable_plugins', 1 );
# enable BASIC auth
t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
# remove any existing plugins that might interfere
Koha::Plugins::Methods->search->delete;
@ -152,9 +156,9 @@ subtest 'Anonymous access routes plugins tests' => sub {
C4::Context->set_preference( 'RESTPublicAnonymousRequests', 0 );
$t->get_ok('/api/v1/contrib/testplugin/public/patrons/bother')
->status_is(200, 'Plugin routes not affected by RESTPublicAnonymousRequests')
->json_is( { bothered => Mojo::JSON->true } );
$t->get_ok('/api/v1/contrib/testplugin/public/patrons/bother')
->status_is(200, 'Plugin routes not affected by RESTPublicAnonymousRequests')
->json_is( { bothered => Mojo::JSON->true } );
C4::Context->set_preference( 'RESTPublicAnonymousRequests', 1 );
@ -162,6 +166,30 @@ subtest 'Anonymous access routes plugins tests' => sub {
->status_is(200, 'Plugin routes not affected by RESTPublicAnonymousRequests')
->json_is( { bothered => Mojo::JSON->true } );
$t->get_ok('/api/v1/contrib/testplugin/patrons/bother')
->status_is(401, 'Plugin routes honour permissions, anonymous access denied');
# Create a patron with permissions, but the wrong ones: 3 => parameters
my $librarian = $builder->build_object(
{
class => 'Koha::Patrons',
value => { flags => 2**3 }
}
);
my $password = 'thePassword123';
$librarian->set_password( { password => $password, skip_validation => 1 } );
my $userid = $librarian->userid;
$t->get_ok("//$userid:$password@/api/v1/contrib/testplugin/patrons/bother")
->status_is(403, 'Plugin routes honour permissions, wrong permissions, access denied');
# Set the patron permissions to the right ones: 4 => borrowers
$librarian->set({ flags => 2 ** 4 })->store->discard_changes;
$t->get_ok("//$userid:$password@/api/v1/contrib/testplugin/patrons/bother")
->status_is(200, 'Plugin routes honour permissions, right permissions, access granted')
->json_is( { bothered => Mojo::JSON->true } );
$schema->storage->txn_rollback;
};