https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23998
Pedro Amorim (ammopt) <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #39 from Pedro Amorim (ammopt) <[email protected]> --- Hi Shi Yao Wang, thanks for the follow-up! Library scoping now follows the patron's library, and message_date can no longer be set, but I don't think we're quite there yet. Two things left: New finding (from the last follow-up): staff without 'view_borrower_infos_from_any_libraries' get a 500 on ?patron_id=, PATCH, PUT and DELETE 1) Give a Centerville staff user (cpl) only 'catalogue', 'list_borrowers' and 'edit_borrowers'. 2) As koha (logged in at Centerville), add a note on patron 51, then get its message_id: curl -s -u koha:koha 'http://localhost:8081/api/v1/messages?patron_id=51' 3) As cpl, run: curl -s -u cpl:<password> 'http://localhost:8081/api/v1/messages?patron_id=51' curl -s -u cpl:<password> -X PATCH -H 'Content-Type: application/json' -d '{"message":"edited"}' http://localhost:8081/api/v1/messages/<message_id> curl -s -u cpl:<password> -X PUT -H 'Content-Type: application/json' -d '{"patron_id":51,"message_type":"L","message":"edited","library_id":"CPL"}' http://localhost:8081/api/v1/messages/<message_id> curl -s -u cpl:<password> -X DELETE http://localhost:8081/api/v1/messages/<message_id> 4) All four return a 500 ("Column ... in where clause is ambiguous" in the logs). They should return 200, 200, 200 and 204: cpl and patron 51 are both at Centerville, and the note was written at Centerville. The join in search_limited makes the unqualified filters ambiguous (branchcode in update/delete, and the patron_id query param, which the API maps to an unqualified borrowernumber). A subquery avoids it, similar to the pattern in Koha/Biblio.pm:412, something like: my $patrons = Koha::Patrons->search( { branchcode => { -in => \@restricted_branchcodes } } ); $params->{'me.borrowernumber'} = { -in => $patrons->_resultset->get_column('borrowernumber')->as_query }; A test with a restricted librarian would catch this: the existing tests use flags => 4**2, which includes 'view_borrower_infos_from_any_libraries', so search_limited never restricts anything. Finding 2 (still): PATCH {"library_id": null} still returns 200 without saving the change. It should return a 400. 1) As koha, get the message_id of a note on patron 51: curl -s -u koha:koha 'http://localhost:8081/api/v1/messages?patron_id=51' 2) Set its library to null: curl -s -u koha:koha -H 'Content-Type: application/json' -X PATCH http://localhost:8081/api/v1/messages/<message_id> -d '{"library_id":null}' 3) It returns 200 with "library_id":null. 4) Check what was saved: curl -s -u koha:koha http://localhost:8081/api/v1/messages/<message_id> 5) library_id is still the original library, so the change wasn't saved. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
