|
Lines 1-84
Link Here
|
| 1 |
package Koha::Patron::Allowlist; |
1 |
package Koha::Patron::Allowlist; |
| 2 |
|
2 |
|
| 3 |
use Modern::Perl; |
3 |
use parent 'Koha::Allowlist'; |
| 4 |
use Array::Utils qw( array_minus ); |
|
|
| 5 |
|
| 6 |
=head1 NAME |
| 7 |
|
| 8 |
Koha::Patron::Allowlist - Allowlist implementation for Koha::Patron |
| 9 |
|
| 10 |
=head1 API |
| 11 |
|
| 12 |
=head2 Class Methods |
| 13 |
|
| 14 |
=head3 new |
| 15 |
|
| 16 |
=cut |
| 17 |
|
| 18 |
sub new { |
| 19 |
my ($class, $args) = @_; |
| 20 |
$args = {} unless defined $args; |
| 21 |
my $self = bless ($args, $class); |
| 22 |
$self->{ui_fields} = { map { $_ => 1 } $self->get_ui_fields() }; |
| 23 |
return $self; |
| 24 |
} |
| 25 |
|
| 26 |
=head3 apply |
| 27 |
|
| 28 |
my $ui_fields = Koha::Patron::Allowlist::Public->new->apply({ input => $hashref, additional_deny_list => [qw( list of fields )] }); |
| 29 |
|
| 30 |
Apply an allowlist to input data. |
| 31 |
|
| 32 |
=cut |
| 33 |
|
| 34 |
sub apply { |
| 35 |
my ( $self, $params ) = @_; |
| 36 |
|
| 37 |
my $input = $params->{input}; |
| 38 |
my $additional_deny_list = $params->{additional_deny_list} || []; |
| 39 |
|
| 40 |
my $blocked = {}; |
| 41 |
my $ui_fields = $self->{ui_fields}; |
| 42 |
return unless $ui_fields and %$ui_fields; |
| 43 |
|
| 44 |
delete $ui_fields->{$_} for @$additional_deny_list; |
| 45 |
|
| 46 |
return unless $input and %$input; |
| 47 |
|
| 48 |
my @keys = keys %$input; |
| 49 |
foreach my $key (@keys){ |
| 50 |
unless ( exists $ui_fields->{ $key } ) { |
| 51 |
#NOTE: We capture the deleted data so that it can be used for logging purposes |
| 52 |
$blocked->{$key} = delete $input->{ $key }; |
| 53 |
} |
| 54 |
} |
| 55 |
|
| 56 |
if ( %$blocked ) { |
| 57 |
while ( my ($k, $v)=each %$blocked){ |
| 58 |
# FIXME We should raise an exception from here |
| 59 |
my @c = caller; |
| 60 |
warn sprintf "Forbidden - Tried to modify '%s' with '%s' from %s", $k, $v, "@c"; |
| 61 |
} |
| 62 |
} |
| 63 |
|
| 64 |
return $blocked; |
| 65 |
} |
| 66 |
|
| 67 |
=head3 get_ui_fields |
| 68 |
|
| 69 |
my $ui_fields = $self->get_ui_fields(); |
| 70 |
my $ui_fields = Koha::Patron::Allowlist::Public->new->get_ui_fields |
| 71 |
|
| 72 |
=cut |
| 73 |
|
| 74 |
sub get_ui_fields { |
| 75 |
my ($self) = @_; |
| 76 |
my @all_fields = $self->_get_all_fields(); |
| 77 |
my @global_deny_list = $self->_global_deny_list(); |
| 78 |
my @deny_list = $self->_deny_list(); |
| 79 |
my @global_allow_list = array_minus @all_fields, @global_deny_list; |
| 80 |
return array_minus @global_allow_list, @deny_list; |
| 81 |
} |
| 82 |
|
4 |
|
| 83 |
# This must not be replaced by Koha::Patrons->columns |
5 |
# This must not be replaced by Koha::Patrons->columns |
| 84 |
# We want developper to not forget to adjust it manually and add new attribute to the deny list if needed |
6 |
# We want developper to not forget to adjust it manually and add new attribute to the deny list if needed |
|
Lines 184-187
sub _global_deny_list {
Link Here
|
| 184 |
); |
106 |
); |
| 185 |
} |
107 |
} |
| 186 |
|
108 |
|
|
|
109 |
sub _deny_list_opac { |
| 110 |
return qw( |
| 111 |
dateenrolled |
| 112 |
dateexpiry |
| 113 |
gonenoaddress |
| 114 |
lost |
| 115 |
borrowernotes |
| 116 |
relationship |
| 117 |
opacnote |
| 118 |
sort1 |
| 119 |
sort2 |
| 120 |
sms_provider_id |
| 121 |
autorenew_checkouts |
| 122 |
); |
| 123 |
} |
| 124 |
|
| 125 |
sub _deny_list_staff { |
| 126 |
return qw(); |
| 127 |
} |
| 128 |
|
| 187 |
1; |
129 |
1; |