https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23998
Pedro Amorim (ammopt) <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] | |k Status|Passed QA |Failed QA --- Comment #34 from Pedro Amorim (ammopt) <[email protected]> --- Hi all, quite a few QA findings here worth addressing: Setup 1) Rebuild the API spec and restart: koha-shell kohadev -c 'cd /kohadevbox/koha && yarn api:bundle' restart_all Finding 1: GET returns 500 once the message's author is deleted 1) Create a patron with username leaver and a password. Then use 'More' > 'Set permissions' to give them 'superlibrarian'. 2) Log out, log in as leaver, and open http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51 3) Click 'Add message', choose 'Staff - Internal note', type "Called about overdue items", and save. 4) Log back in as koha and delete leaver ('More' > 'Delete'). 5) Run this. It returns a 500 with Expected integer - got null: curl -s -u koha:koha 'http://localhost:8081/api/v1/messages?patron_id=51' 6) Open http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51. The staff interface still shows the note without any problem. Finding 2: library_id is optional in the spec, but a message can't be saved without it 1) Run this. It returns a 500: curl -s -u koha:koha -H 'Content-Type: application/json' -X POST http://localhost:8081/api/v1/messages \ -d '{"patron_id":51,"message_type":"L","message":"no library"}' 2) Check http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51. There's no "no library" message. Expected: either a 400 saying library_id is required, or the API defaults library_id to the logged-in user's library. Finding 3: PATCH returns 200 but doesn't save 1) Add a message and note the message_id in the response, <ID>: curl -s -u koha:koha -H 'Content-Type: application/json' -X POST http://localhost:8081/api/v1/messages \ -d '{"patron_id":51,"library_id":"CPL","message_type":"L","message":"Prefers phone calls"}' 2) Clear the message text: curl -s -u koha:koha -H 'Content-Type: application/json' -X PATCH http://localhost:8081/api/v1/messages/<ID> -d '{"message":""}' It returns 200 with "message":"", so it looks as if it saved. 3) Open http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51. The message still reads "Prefers phone calls", because nothing was saved. Finding 4: staff without 'view_borrower_infos_from_any_libraries' can read other libraries' internal messages 1) Create a staff patron at 'Fairfield' with username ffl and a password, and give them only 'Borrowers' > 'list_borrowers' and 'edit_borrowers'. Make sure 'view_borrower_infos_from_any_libraries' is not ticked. 2) Run this. It returns 404: without 'view_borrower_infos_from_any_libraries', they can't see koha's patron record at CPL: curl -s -u ffl:<password> http://localhost:8081/api/v1/patrons/51 3) Run this, using <ID> from Finding 3. It returns 200 with koha's internal ("L") message "Prefers phone calls" at CPL, so the same permission check isn't applied to messages: curl -s -u ffl:<password> http://localhost:8081/api/v1/messages/<ID> Finding 5: the API edits and deletes other libraries' messages despite AllowAllMessageDeletion 1) Leave 'AllowAllMessageDeletion' set to "Don't allow" (the KTD default). 2) Give ffl these extra permissions so they can see koha: 'catalogue' (staff login) and 'Borrowers' > 'view_borrower_infos_from_any_libraries'. 3) Log in as ffl at 'Fairfield' and open http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 4) Look at the "Prefers phone calls" message from Finding 3 (a CPL message). There's no 'Edit' or 'Delete' next to it. 5) Now delete it through the API as ffl: curl -s -u ffl:<password> -X DELETE http://localhost:8081/api/v1/messages/<ID> -w '%{http_code}\n' 6) It returns 204. Refresh the patron page and the message is gone. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
