Koha-clms/Koha/REST
Martin Renvoize 88b16e6445
Bug 10190: Enforce manage_circ_rules_from_any_libraries permission
- Add OR-type x-koha-authorization to /circulation_rules, /circulation_rules/kinds,
  and /circulation_rules/config endpoints so users with either
  circulate:circulate_remaining_permissions OR parameters:manage_circ_rules
  can access them
- Enforce manage_circ_rules_from_any_libraries in the set_rules controller:
  users without this permission may only set rules for their own library and
  cannot set default (*) rules
- Add explicit use C4::Auth qw(haspermission) import to CirculationRules.pm
- Lock the library selector in the Vue UI for users who lack
  manage_circ_rules_from_any_libraries, defaulting them to their own library
- Update set_rules() tests to cover the new permission restrictions

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
2026-09-10 14:25:02 +00:00
..
Plugin Bug 43241: Fix datetime/boolean conversion in q= queries with DBIC operators 2026-08-28 16:36:36 +00:00
V1 Bug 10190: Enforce manage_circ_rules_from_any_libraries permission 2026-09-10 14:25:02 +00:00
V1.pm Revert "Bug 34451: Add CSRF protection for REST API (cookie-auth only)" 2026-07-27 16:06:36 +00:00