Bug 20568: (QA follow-up) Remove api-key management from OPAC
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Tomas Cohen Arazi
Jonathan Druart
parent
45841d9ec7
commit
82edceb2ed
|
|
@ -20,13 +20,6 @@ if(CheckVersion($DBversion)) {
|
|||
});
|
||||
}
|
||||
|
||||
$dbh->do(q{
|
||||
INSERT IGNORE INTO `systempreferences`
|
||||
(variable,value,explanation,options,type)
|
||||
VALUES
|
||||
('AllowPatronsManageAPIKeysInOPAC', '0', 'If enabled, patrons can manage their own API keys in the OPAC', NULL, 'YesNo');
|
||||
});
|
||||
|
||||
print "Upgrade to $DBversion done (Bug 20568 - Add API key management interface for patrons)\n";
|
||||
SetVersion($DBversion);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -30,7 +30,6 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
|
|||
('AllowNotForLoanOverride','0','','If ON, Koha will allow the librarian to loan a not for loan item.','YesNo'),
|
||||
('AllowOfflineCirculation','0','','If on, enables HTML5 offline circulation functionality.','YesNo'),
|
||||
('AllowPatronToSetCheckoutsVisibilityForGuarantor', '0', NULL, 'If enabled, the patron can set checkouts to be visible to his or her guarantor', 'YesNo'),
|
||||
('AllowPatronsManageAPIKeysInOPAC', '0', NULL, 'If enabled, patrons can manage their own API keys in the OPAC', 'YesNo'),
|
||||
('AllowPKIAuth','None','None|Common Name|emailAddress','Use the field from a client-side SSL certificate to look a user in the Koha database','Choice'),
|
||||
('AllowPurchaseSuggestionBranchChoice','0','1','Allow user to choose branch when making a purchase suggestion','YesNo'),
|
||||
('AllowRenewalIfOtherItemsAvailable','0',NULL,'If enabled, allow a patron to renew an item with unfilled holds if other available items can fill that hold.','YesNo'),
|
||||
|
|
|
|||
|
|
@ -5,12 +5,6 @@ Web services:
|
|||
- pref: "RESTdefaultPageSize"
|
||||
class: integer
|
||||
- "per page"
|
||||
-
|
||||
- pref: AllowPatronsManageAPIKeysInOPAC
|
||||
choices:
|
||||
yes: Allow
|
||||
no: "Don't allow"
|
||||
- "patrons to manage their own API keys in the OPAC."
|
||||
OAI-PMH:
|
||||
-
|
||||
- pref: OAI-PMH
|
||||
|
|
|
|||
|
|
@ -124,16 +124,6 @@
|
|||
<a href="/cgi-bin/koha/opac-illrequests.pl">your interlibrary loan requests</a></li>
|
||||
[% END %]
|
||||
|
||||
|
||||
[% IF Koha.Preference('AllowPatronsManageAPIKeysInOPAC') %]
|
||||
[% IF apikeysview %]
|
||||
<li class="active">
|
||||
[% ELSE %]
|
||||
<li>
|
||||
[% END %]
|
||||
<a href="/cgi-bin/koha/opac-apikeys.pl">your API keys</a>
|
||||
[% END %]
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
[% END %]
|
||||
|
|
|
|||
|
|
@ -1,110 +0,0 @@
|
|||
[% INCLUDE 'doc-head-open.inc' %]
|
||||
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › Your API keys</title>
|
||||
[% INCLUDE 'doc-head-close.inc' %]
|
||||
[% BLOCK cssinclude %][% END %]
|
||||
</head>
|
||||
[% INCLUDE 'bodytag.inc' bodyid='opac-user' bodyclass='scrollto' %]
|
||||
[% INCLUDE 'masthead.inc' %]
|
||||
|
||||
<div class="main">
|
||||
<ul class="breadcrumb">
|
||||
<li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">›</span></li>
|
||||
<li>
|
||||
<a href="/cgi-bin/koha/opac-user.pl">
|
||||
[% INCLUDE 'patron-title.inc' category_type=patron.category.category_type firstname=patron.firstname surname=patron.surname othernames=patron.othernames %]
|
||||
</a>
|
||||
<span class="divider">›</span>
|
||||
</li>
|
||||
<li><a href="/cgi-bin/koha/opac-apikeys.pl">Your API keys</a></li>
|
||||
</ul>
|
||||
|
||||
<div class="container-fluid">
|
||||
<div class="row-fluid">
|
||||
<div class="span2">
|
||||
<div id="navigation">
|
||||
[% INCLUDE 'navigation.inc' IsPatronPage = 1 %]
|
||||
</div>
|
||||
</div>
|
||||
<div class="span10">
|
||||
<div id="apikeys" class="maincontent">
|
||||
<h1>Your API keys</h1>
|
||||
<p>
|
||||
<button id="show-api-form" style="display:none" class="btn btn-default btn-sm" type="button"><i class="fa fa-plus"></i> Generate new key</button>
|
||||
</p>
|
||||
<form id="add-api-key" action="/cgi-bin/koha/opac-apikeys.pl" method="post">
|
||||
<fieldset>
|
||||
<legend>Generate new client id/secret pair</legend>
|
||||
<input type="hidden" name="patron_id" value="[% patron.id %]" />
|
||||
<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
|
||||
<input type="hidden" name="op" value="generate" />
|
||||
<label for="description">Description: </label>
|
||||
<input type="text" name="description" />
|
||||
</fieldset>
|
||||
<fieldset class="action">
|
||||
<button class="btn btn-default btn-sm" type="submit">Save</button> <a href="#" style="display:none" class="cancel cancel-api-key">Cancel</a>
|
||||
</fieldset>
|
||||
</form>
|
||||
[% IF api_keys && api_keys.size > 0 %]
|
||||
<table class="table table-bordered table-striped">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Description</th>
|
||||
<th>Client ID</th>
|
||||
<th>Secret</th>
|
||||
<th>Active</th>
|
||||
<th>Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
[% FOREACH key IN api_keys %]
|
||||
<tr>
|
||||
<td>[% key.description %]</td>
|
||||
<td>[% key.client_id %]</td>
|
||||
<td>[% key.secret %]</td>
|
||||
<td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>
|
||||
<td>
|
||||
<form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
|
||||
<input type="hidden" name="key" value="[% key.id %]" />
|
||||
<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
|
||||
<input type="hidden" name="op" value="delete" />
|
||||
<button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>
|
||||
</form>
|
||||
<form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
|
||||
<input type="hidden" name="key" value="[% key.id %]" />
|
||||
<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
|
||||
[% IF key.active %]
|
||||
<input type="hidden" name="op" value="revoke" />
|
||||
<button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>
|
||||
[% ELSE %]
|
||||
<input type="hidden" name="op" value="activate" />
|
||||
<button class="btn btn-link btn-xs" type="submit"><i class="fa fa-play"></i> Activate</button>
|
||||
[% END %]
|
||||
</form>
|
||||
</td>
|
||||
</tr>
|
||||
[% END %]
|
||||
</tbody>
|
||||
</table>
|
||||
[% ELSE %]
|
||||
<p>No keys defined for the current patron.</p>
|
||||
[% END %]
|
||||
</div> <!-- /#apikeys -->
|
||||
</div> <!-- /.span10 -->
|
||||
</div> <!-- /.row-fluid -->
|
||||
</div> <!-- /.container-fluid -->
|
||||
</div> <!-- /#main -->
|
||||
|
||||
[% BLOCK jsinclude %]
|
||||
<script>
|
||||
$(document).ready(function(){
|
||||
$("#add-api-key, #show-api-form, .cancel-api-key").toggle();
|
||||
$("#show-api-form, .cancel-api-key").on("click", function(){
|
||||
$("#add-api-key, #show-api-form").toggle();
|
||||
});
|
||||
$(".delete-key").on("click", function(){
|
||||
return confirm(_("Are you sure you want to delete this key?"));
|
||||
});
|
||||
});
|
||||
</script>
|
||||
[% END %]
|
||||
[% INCLUDE 'opac-bottom.inc' %]
|
||||
|
|
@ -1,119 +0,0 @@
|
|||
#!/usr/bin/env perl
|
||||
|
||||
# This file is part of Koha.
|
||||
#
|
||||
# Copyright 2015 BibLibre
|
||||
#
|
||||
# Koha is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Koha is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Koha; if not, see <http://www.gnu.org/licenses>.
|
||||
|
||||
use Modern::Perl;
|
||||
|
||||
use CGI;
|
||||
|
||||
use C4::Auth;
|
||||
use C4::Output;
|
||||
|
||||
use Koha::ApiKeys;
|
||||
use Koha::Patrons;
|
||||
use Koha::Token;
|
||||
|
||||
my $cgi = new CGI;
|
||||
|
||||
my ($template, $loggedinuser, $cookie) = get_template_and_user({
|
||||
template_name => 'opac-apikeys.tt',
|
||||
query => $cgi,
|
||||
type => 'opac',
|
||||
authnotrequired => 0
|
||||
});
|
||||
|
||||
my $patron_id = $loggedinuser;
|
||||
my $patron = Koha::Patrons->find( $patron_id );
|
||||
|
||||
if ( not defined $patron
|
||||
or !C4::Context->preference('AllowPatronsManageAPIKeysInOPAC') )
|
||||
{
|
||||
# patron_id invalid -> exit
|
||||
print $cgi->redirect("/cgi-bin/koha/errors/404.pl"); # escape early
|
||||
exit;
|
||||
}
|
||||
|
||||
my $op = $cgi->param('op') // '';
|
||||
|
||||
if ( $op eq 'generate' or
|
||||
$op eq 'delete' or
|
||||
$op eq 'revoke' or
|
||||
$op eq 'activate' ) {
|
||||
|
||||
die "Wrong CSRF token"
|
||||
unless Koha::Token->new->check_csrf({
|
||||
session_id => scalar $cgi->cookie('CGISESSID'),
|
||||
token => scalar $cgi->param('csrf_token'),
|
||||
});
|
||||
}
|
||||
|
||||
if ($op) {
|
||||
if ($op eq 'generate') {
|
||||
my $description = $cgi->param('description') // '';
|
||||
my $apikey = Koha::ApiKey->new({
|
||||
patron_id => $patron_id,
|
||||
description => $description
|
||||
});
|
||||
$apikey->store;
|
||||
print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
|
||||
exit;
|
||||
}
|
||||
|
||||
if ($op eq 'delete') {
|
||||
my $key_id = $cgi->param('key');
|
||||
my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });
|
||||
if ($api_key) {
|
||||
$api_key->delete;
|
||||
}
|
||||
print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
|
||||
exit;
|
||||
}
|
||||
|
||||
if ($op eq 'revoke') {
|
||||
my $key_id = $cgi->param('key');
|
||||
my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });
|
||||
if ($api_key) {
|
||||
$api_key->active(0);
|
||||
$api_key->store;
|
||||
}
|
||||
print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
|
||||
exit;
|
||||
}
|
||||
|
||||
if ($op eq 'activate') {
|
||||
my $key_id = $cgi->param('key');
|
||||
my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });
|
||||
if ($api_key) {
|
||||
$api_key->active(1);
|
||||
$api_key->store;
|
||||
}
|
||||
print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });
|
||||
|
||||
$template->param(
|
||||
api_keys => \@api_keys,
|
||||
apikeysview => 1,
|
||||
csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
|
||||
patron => $patron
|
||||
);
|
||||
|
||||
output_html_with_http_headers $cgi, $cookie, $template->output;
|
||||
Loading…
Reference in New Issue