This change turns off ABSOLUTE and EVAL_PERL for user-entered templates,
as these options can allow for arbitrary code execution and information
disclosure.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a Notice for Reports with a report like:
[% IF ( x == 1 ) %]
One
[% ELSE %]
Two
[% END %]
3. Run a report using this template
4. The report should show "Two"
5. Turn on CHECKOUT emails for a test patron
6. Perform a checkout
7. Look at the CHECKOUT email and note that the email body
is correctly generated
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Would be good to have this fixed as the default.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
The test plan should include PERL blocks or absolute paths! Tested those
instead. Testing x==1 seems irrelevant.
I tried:[% PERL %]print 1;[% END %] and [% INCLUDE /app/Dockerfile_1 %]
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 1794924eeb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When ILS-DI is disabled we still expect to return the correct service name/section in the
xml, but just indicate that it is disabled.
We should skip the check for authorized IPs in this case, as the IP only matters when service is enabled
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit fd6d58bb4b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This lists the new syntax for allowing all IPs in the preference
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 7589c3b6d8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed
To test:
1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank
2 - In another window:
http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item
3 - You get a response
4 - Apply patch and restart all
5 - Reload ilsdi page, 'Not authorized'
6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs
7 - Reload the page, you get a response again
8 - Change ILS-DI:AuthorizedIPs to:
0:0:0:0/0
9 - You still have access
10 - Paste your specific IP again, and add a second made up IP (comma separated)
11 - Reload and confirm you still have access
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 5fcc519aa3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Typo in system preference 'minPasswordPreference' -> 'minPasswordLength'
in opac/opac-password-recovery.pl
There is no 'minPasswordPreference' system preference in database.
Bug 23816 added the capability to override minPasswordLength.
Test plan:
==========
1. Check 'minPasswordPreference' appearances:
git grep -i 'minPasswordPreference' **/*
--> Note: only one in opac-password-recovery.pl; no one in sysprefs.sql
2. Apply the patch.
3. Repeat p. 1. Note there is not 'minPasswordPreference' at all.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4b8db36d2a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 6ef34a6e3e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This is in opac/opac-search.pl a call on system preference
OPACLocalCoverImagesPriority. This preference does not exists elsewhere
and dates back to Koha 3.8 from Bug 1633
This patch removes the call and fixes folding of if.
Check this returns empty : git grep OPACLocalCoverImagesPriority
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit bf82831913)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 35bee8465a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch moves the logic up one level into the confirmModal function
to prevent future regressions
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1fc336d6bd)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 1667d7db42)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Templates that use confirmModal to show a pretty confirm() need to
remove the modal in their callback function, or they are at risk of
having the first callback called for subsequent calls that think they
will get their own callback called. opac-user.tt is already fixed,
opac-shelves.tt is currently affected, and opace-suggestions.tt,
opac-tags.tt, and sco/sco-main.tt are at risk of being affected if
anyone adds another confirmModal caller.
Test plan:
1. Without the patch, open the OPAC, log in, search for something that
will return several results
2. Select all - Add to list - New list
3. Lists - {your list name}
4. Click the checkboxes for the first two items
5. Instead of clicking Remove from list, accidentally click Delete list
6. In the confirmation popup, realize it was a mistake and click No, do
not delete
7. Click Remove from list
8. Poof, your whole list is gone
9. Apply patch
10. Repeat steps 1-7, but instead of the whole list being deleted, see
that only the selected two items were removed
11. Now intentionally click Delete list and click Yes, delete, you'll
see that it is deleted rather than getting a message about nothing
being removed like you would have gotten without the patch if you
started by removing an item
12. On any bib detail page, click Add tag(s) and add one
13. Your account - Tags, check the checkbox for the tag, Remove selected
tags, Yes, delete tag and verify that it was deleted
14. Purchase suggestions - New purchase suggestion, fill in a title and
submit your suggestion, click the checkbox for your suggestion,
Delete selected, Yes, delete suggestion and verify it was deleted
15. In the staff interface, find and copy the barcode for any item that can
be checked out, then go to /cgi-bin/koha/sco/sco-main.pl with the
OPAC hostname and port, not the staff, and log in
16. Paste the barcode in the input, click Submit, then click Finish, and
in the confirmation popup click Print recept and end session, and
verify that it tries to print
Sponsored-by: Chetco Community Public Library
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6b470caa92)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 7e5319280a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save
6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"
12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"
16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit cf3874f8a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This resolves exceptions like:
Invalid table name accountlines at /usr/share/koha/C4/Reports/Guided.pm line 216.
Test plan:
Go to reports/dictionary.pl
Try to add a new definition for Serials.
Without this patch, you would crash (status 500).
Run t/Koha/Database/Columns.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit d485d1f2ae)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The code went back to step 3 but the error message is not there.
It is easier to go back to the start: no need to fetch columns.
And this is now an exception; it will only come up when trying
malicious things.
Also turned foreach and unless forbidden around. No need to go
into the loop when we found a forbidden field.
Test plan:
See first patch. You should see the message now.
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit a4888ff9a9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch prevents forbidden columns from being selected using the reports dictionary.
To test:
1. Go to Reports -> View dictionary
2. Choose 'new dictionary'
3. After providing a name and description, select the 'patrons' table
4. Select the 'password' column and go Next
5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value
6. Apply patch and restart services
7. Repeat steps 1-3
8. Notice the 'password' column and other forbidden columns are not available to be selected
9. Open the Inspector / developer tools in your browser and find the code for the columns selection
10. Change the value of one of the options in the code to "borrowers.password". So it may end up looking like this:
<option value="borrowers.password">Card number</option>
11. Choose that option from the dropdown and click Next.
12. Confirm you are redirected back to this page and warned about the column being used.
13. Ensure tests pass t/db_dependent/Reports/Guided.t
Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit dbfb62c63b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The purpose of no block checkouts in SIP is to indicate that the SIP machine has made an offline ( "store and forward" ) transaction.
The patron already has the item. As such, the item must be checked out to the patron or the library risks losing the item do to lack of tracking.
As such, no block checkouts should not be blocked under any circumstances.
The sub C4::SIP::ILS::Transaction::Checkout::do_checkout already honors this, but it is wrapped by
C4::SIP::ILS::checkout which has additional checks that do not.
Test Plan:
1) Apply the unit test patch
2) prove t/db_dependent/SIP/Transaction.t will fail
3) Apply the second patch
4) prove t/db_dependent/SIP/Transaction.t will pass!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 56d2ccc3f7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change makes $sessionID consistently return using the session
ID and not sometimes the session object.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies
3. Note the Csrf-Token header value
4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step
using the appropriate values (eg the CSRF-TOKEN is from the previous step)
5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \
-H "Csrf-Token: <CSRF-TOKEN>" -XPOST \
'http://localhost:8081/cgi-bin/koha/svc/authentication' \
-d "login_userid=<USERID>&login_password=<PASSWORD>" \
--cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
--cookie /tmp/test.cookies > rec.marcxml
7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \
--cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
8. Note the Csrf-Token header value
9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \
-XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
--cookie /tmp/test.cookies --data @rec.marcxml
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 04dbbcc2f2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit b20741c4eb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
HTML customizations and news will not display without a publication
date, so we should make it required. This patch adds client-side
validation of the field to check that it's filled.
To test, apply the patch and go to Tools -> News (or HTML
customizations, or Pages).
- Click "New entry"
- Try to submit this new entry without entering a publication date.
- You should be prevented from submitting the form.
- Fill in the publication date and confirm that the form submits
correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1b1e96a17c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 65b73ac349)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch makes the following scripts use the new method for checking
suppression:
* opac/opac-ISBDdetail.pl
* opac/opac-MARCdetail.pl
* opac/opac-detail.pl
In the `opac-detail.pl` case, it is a simple change by removing MARC
data traversal in favor of the new method. The code checking
suppression gets moved up so we don't process or make any other
calculations if the record is suppressed.
The other two scripts where completely missing the check and thus
leaking suppressed records.
To test:
1. Pick two records, one marked as suppressed, and the other not
suppressed.
2. Try acessing them in the OPAC detail page.
=> SUCCESS: Suppressed records are suppressed, and not suppressed ones
are not.
3. Try the same records on the ISBD and MARC view
=> FAIL: They are not suppressed!
4. Apply this patch
5. Repeat 2
=> SUCCESS: Suppression is still respected
6. Repeat 3
=> SUCCESS: Suppression is respected on the ISBD and MARC views
7. Sign off :-D
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. Remember to activate OPAC suppression with
OpacSuppression.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 5b775aee69)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a convenient method at the Koha::Biblio level, as a
wrapper for the extrator added on this bug. Following the established
pattern we adopted a while back.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/Koha/Biblio.t
=> SUCCESS: Tests pass! All use cases covered!
3. Sign off :-D
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit c1e2a4f164)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds an extractor method for the historically hardcoded field
942$n. This way we have a single place in which we code the extraction
and sanitization of its value.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/Koha/Biblio/Metadata/Extractor/MARC.t
=> SUCCESS: Tests pass! All use cases are covered!
3. Sign off :-D
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit b8ff17d259)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Resolve (when running ArticleRequests.t):
Exception 'Koha::Exceptions::Account::IsNotDebit' thrown 'Account line 326 is not a debit'
This occurs after switching from ArticleRequest->new to TestBuilder.
TestBuilder creates an account line that has a credit_type_code and
a debit_type_code. (This could be fixed further somewhere else.)
For now, just setting debit_id to NULL.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit a8078a4f3d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 5a8aef083d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 05353f0cf0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 5ff06fd18d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!
Let support both here.
This patch also removes silly JS code in the template.
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 7b0f6f6bc1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
Add article request with format via OPAC.
Run t/db_dependent/Koha/ArticleRequest.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tests in t/db_dependent/Koha/ArticleRequest.t pass. I can add an
article request with a type. If I allow PHOTOCOPY but change the
HTML in the OPAC form so SCAN is submitted I get a nice (but
somewhat generic) error.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 3a817ca380)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change improves the validation of the report ID passed by the user.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a SQL report
3. Go to /cgi-bin/koha/tools/scheduler.pl
4. Add in a Time, Date, and Email
5. Choose your report from the list
6. Click "Save"
7. Note that your report is saved
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)
3. To test the XSS is patched, try the proof-of-concept from the
bug report
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 89c6e32ee7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".
Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit c536935238)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1) Run prove t/db_dependent/api/v1/erm_sushi_services.t - FAIL
2) Apply patch
3) Repeat step 1 - PASS
4) Inspect patch diff and note that last_audit has been added to the API definition
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Please enter the commit message for your changes. Lines starting
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 020a27cdd7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.
Old method, was applicable to both privileged and public routes:
api/v1/swagger/paths/route.yaml
x-koha-authorization:
allow-owner: true
allow-guarantor: true
New method, use public routes with no x-koha-authorization:
GET /public/route/{patron_id}
Koha/REST/V1/Controller#public_action:
sub public_action {
my $c = shift->openapi->valid_input or return;
my $patron_id = $c->param( 'patron_id' );
try {
# Throws an exception that will render a response of 401 if not
# authenticated and 403 if trying to access another user's resources
$c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
...
# other code
...
}
catch {
$c->unhandled_exception($_);
}
}
Another example of retrieving $patron_id when patron_id is not a request
parameter:
GET /public/another/object/{another_object_id}
my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
try {
# 403 if $another_object_id does not belong to API user
$c->auth->public($patron_id);
...
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 8a1c0af3e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm
More tests coming in following patches.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit aa97527c37)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 3371577b42)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Fridolin Somers
David Cook
Nick Clemens
Jonathan Druart
Roman Dolny
Matt Blenkinsop
Phil Ringnalda
Marcel de Rooy
Aleisha Amohia
Kyle M Hall
Owen Leonard
Tomas Cohen Arazi
Lari Taskula