Bugzilla – Attachment 148290 Details for
Bug 32713
x-koha-embed appears to no longer properly validate
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 32713: Throw exception on unexpected x-koha-embed header
Bug-32713-Throw-exception-on-unexpected-x-koha-emb.patch (text/plain), 2.78 KB, created by
Tomás Cohen Arazi
on 2023-03-16 19:03:44 UTC
(
hide
)
Description:
Bug 32713: Throw exception on unexpected x-koha-embed header
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi
Created:
2023-03-16 19:03:44 UTC
Size:
2.78 KB
patch
obsolete
>From 5c3072016fab7438eba9de45ebf79de6e52aa027 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Wed, 1 Mar 2023 16:42:30 +0000 >Subject: [PATCH] Bug 32713: Throw exception on unexpected x-koha-embed header > >This patch adds an exception to stash_embed that is thrown when we >find an x-koha-embed header that we're not expecting. > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/REST/Plugin/Query.pm | 20 +++++++++++++++++--- > Koha/REST/V1/Auth.pm | 2 +- > 2 files changed, 18 insertions(+), 4 deletions(-) > >diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm >index 5ce0da42f35..432a0d8fab2 100644 >--- a/Koha/REST/Plugin/Query.pm >+++ b/Koha/REST/Plugin/Query.pm >@@ -228,7 +228,7 @@ Merges parameters from $q_params into $filtered_params. > > =head3 stash_embed > >- $c->stash_embed(); >+ $c->stash_embed( { spec => $op_spec } ); > > Unwraps and stashes the x-koha-embed headers for use later query construction > >@@ -237,14 +237,28 @@ Unwraps and stashes the x-koha-embed headers for use later query construction > $app->helper( > 'stash_embed' => sub { > >- my ( $c ) = @_; >+ my ( $c, $args ) = @_; >+ > my $embed_header = $c->req->headers->header('x-koha-embed'); >+ return $c unless $embed_header; >+ >+ my $spec = $args->{spec} // {}; >+ my $embed_spec; >+ for my $param ( @{ $spec->{parameters} } ) { >+ next unless $param->{name} eq 'x-koha-embed'; >+ $embed_spec = $param->{items}->{enum}; >+ } >+ Koha::Exceptions::BadParameter->throw( >+ "Embedding objects is not allowed on this endpoint.") >+ unless defined($embed_spec); >+ > if ($embed_header) { > my $THE_embed = {}; > foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { > if ( $embed_req eq '+strings' ) { # special case > $c->stash( 'koha.strings' => 1 ); >- } else { >+ } >+ else { > _merge_embed( _parse_embed($embed_req), $THE_embed ); > } > } >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 8e8a6f675cb..1b2a9c090bc 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -157,7 +157,7 @@ sub authenticate_api_request { > # TODO: remove the latter 'openapi.op_spec' if minimum version is bumped to at least 1.17. > my $spec = $c->openapi->spec || $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; > >- $c->stash_embed(); >+ $c->stash_embed( { spec => $spec } ); > $c->stash_overrides(); > > my $cookie_auth = 0; >-- >2.40.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 32713
:
147586
|
147587
|
147820
|
147821
|
148289
| 148290 |
148386