gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 23634: (QA follow-up) Catch all email cases in API 

The API was only catching the primary email change case, but we need to
catch email, emailpro and B_email.

We were also not accounting for any of the emails (on PUT or from the
DB) being undefined.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
This commit is contained in:
Martin Renvoize 2020-07-10 09:38:31 +01:00 committed by Aleisha Amohia
parent d867d1b8dd
commit ccd95fdb45
2 changed files with 51 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Koha/REST/V1/Patrons.pm
View File

@ -198,10 +198,23 @@ sub update {
my $user = $c->stash('koha.user');
if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) {
my $put_email = $body->{email} // qw{};
my $db_email = $patron->email // qw{};
my $put_email_pro = $body->{secondary_email} // qw{};
my $db_email_pro = $patron->emailpro // qw{};
my $put_email_B = $body->{altaddress_email} // qw{};
my $db_email_B = $patron->B_email // qw{};
return $c->render(
status => 403,
openapi => { error => "Not enough privileges to change a superlibrarian's email" }
) if $body->{email} ne $patron->email ;
openapi => {
error =>
"Not enough privileges to change a superlibrarian's email"
}
)
if ($put_email ne $db_email)
|| ($put_email_pro ne $db_email_pro)
|| ($put_email_B ne $db_email_B);
}
$patron->set_from_api($c->validation->param('body'))->store;

37
t/db_dependent/api/v1/patrons.t
View File

@ -222,7 +222,7 @@ subtest 'update() tests' => sub {
$schema->storage->txn_rollback;
subtest 'librarian access tests' => sub {
plan tests => 25;
plan tests => 40;
$schema->storage->txn_begin;
@ -341,11 +341,46 @@ subtest 'update() tests' => sub {
$newpatron->{userid} = $superlibrarian->userid;
$newpatron->{email} = 'nosense@no.no';
# attempt to update
$authorized_patron->flags( 2**4 )->store; # borrowers flag = 4
$t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
->json_is( { error => "Not enough privileges to change a superlibrarian's email" } );
# attempt to unset
$newpatron->{email} = undef;
$t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden")
->json_is( { error => "Not enough privileges to change a superlibrarian's email to undefined" } );
$newpatron->{email} = $superlibrarian->email;
$newpatron->{secondary_email} = 'nonsense@no.no';
# attempt to update
$t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email forbidden")
->json_is( { error => "Not enough privileges to change a superlibrarian's secondary_email" } );
# attempt to unset
$newpatron->{secondary_email} = undef;
$t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email forbidden")
->json_is( { error => "Not enough privileges to change a superlibrarian's secondary_email to undefined" } );
$newpatron->{secondary_email} = $superlibrarian->emailpro;
$newpatron->{altaddress_email} = 'nonsense@no.no';
# attempt to update
$t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email forbidden")
->json_is( { error => "Not enough privileges to change a superlibrarian's altaddress_email" } );
# attempt to unset
$newpatron->{altaddress_email} = undef;
$t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron )
->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email forbidden")
->json_is( { error => "Not enough privileges to change a superlibrarian's altaddress_email to undefined" } );
$schema->storage->txn_rollback;
};
};