https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24401
--- Comment #77 from Tomás Cohen Arazi (tcohen) <[email protected]> --- Created attachment 209543 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209543&action=edit Bug 24401: (QA follow-up) Close exempt_fine permission gap, default library_id circ/returns.pl only allows exemptfine through to AddReturn when the operator holds 'updatecharges' => 'writeoff' - the comment there is explicit that this exists to stop an unauthorized operator forgiving overdue fines by tweaking form parameters. POST /checkins passed exempt_fine straight through with no such check, gated only by circulate_remaining_permissions, reopening exactly that hole via the API. Mirror the CGI guard: silently drop the flag for anyone lacking the permission, same as the staff interface does, rather than rejecting the whole checkin. Also default library_id to the logged in user's library (the same fallback AddReturn itself applies) on both endpoints when the caller doesn't supply one, so a GET /checkins/availability dry-run agrees with what a same-request POST /checkins would actually do. Finally, document (as a FIXME, not yet fixed) that add() never inspects AddReturn's $doreturn/$messages, so it always renders 200 even when the checkin didn't complete, and that the outcome messages Koha::Checkin->attach_messages builds never reach the API response. Also adds the missing GPL/copyright header this file was missing. Test plan: 1. prove t/db_dependent/api/v1/checkins.t => SUCCESS: passes. 2. As a user without 'updatecharges' => 'writeoff', POST /checkins with exempt_fine: true against an item with an outstanding overdue fine; confirm the fine is NOT forgiven. Signed-off-by: Martin Renvoize <[email protected]> Signed-off-by: Brendan Lawlor <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
