gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 25045: Allow restricting anonymous requests on the public API 

This patch introduces a check on the authenticate_api_request method for
the RESTPublicAnonymousRequests system preference. If disabled,
anonymous  requests get rejected.

The idea is to replicate the homologous OpacPublic system preference
behaviour.

To test:
1. Apply the Unit tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
=> FAIL: Tests fail, 200 is answered instead of 401 on the route.
3. Apply this patch
4. Repeat 2.
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This commit is contained in:
Tomas Cohen Arazi 2020-04-13 11:40:48 -03:00 committed by Martin Renvoize
parent 78cb447c7c
commit ec99043a2e
No known key found for this signature in database
GPG Key ID: 422B469130441A0F
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Koha/REST/V1/Auth.pm
View File

@ -63,8 +63,9 @@ sub under {
# /api/v1/{namespace}
my $namespace = $c->req->url->to_abs->path->[2] // '';
my $is_public = ($namespace eq 'public') ? 1 : 0;
if ( $namespace eq 'public'
if ( $is_public
and !C4::Context->preference('RESTPublicAPI') )
{
Koha::Exceptions::Authorization->throw(
@ -76,7 +77,7 @@ sub under {
$status = 1;
}
else {
$status = authenticate_api_request($c);
$status = authenticate_api_request($c, { is_public => $is_public });
}
} catch {
@ -132,7 +133,7 @@ if authorization is required and user has required permissions to access.
=cut
sub authenticate_api_request {
my ( $c ) = @_;
my ( $c, $params ) = @_;
my $user;
@ -235,7 +236,10 @@ sub authenticate_api_request {
$c->stash('koha.user' => $user);
if ( !$authorization ) {
if ( !$authorization and
( $params->{is_public} and
( C4::Context->preference('RESTPublicAnonymousRequests') or
$user) ) ) {
# We do not need any authorization
# Check the parameters
validate_query_parameters( $c, $spec );