79c1853b2b
This change adds a `api_validate_password` permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission `api_validate_password` appears under the "borrowers" permission Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> |
||
|---|---|---|
| .. | ||
| audio_alerts.sql | ||
| auth_val_cat.sql | ||
| keyboard_shortcuts.sql | ||
| message_transport_types.sql | ||
| sample_notices_message_attributes.sql | ||
| sample_notices_message_transports.sql | ||
| subtag_registry.sql | ||
| sysprefs.sql | ||
| userflags.sql | ||
| userpermissions.sql | ||