Lines 1-84
Link Here
|
1 |
package Koha::Patron::Allowlist; |
1 |
package Koha::Patron::Allowlist; |
2 |
|
2 |
|
3 |
use Modern::Perl; |
3 |
use parent 'Koha::Allowlist'; |
4 |
use Array::Utils qw( array_minus ); |
|
|
5 |
|
6 |
=head1 NAME |
7 |
|
8 |
Koha::Patron::Allowlist - Allowlist implementation for Koha::Patron |
9 |
|
10 |
=head1 API |
11 |
|
12 |
=head2 Class Methods |
13 |
|
14 |
=head3 new |
15 |
|
16 |
=cut |
17 |
|
18 |
sub new { |
19 |
my ($class, $args) = @_; |
20 |
$args = {} unless defined $args; |
21 |
my $self = bless ($args, $class); |
22 |
$self->{ui_fields} = { map { $_ => 1 } $self->get_ui_fields() }; |
23 |
return $self; |
24 |
} |
25 |
|
26 |
=head3 apply |
27 |
|
28 |
my $ui_fields = Koha::Patron::Allowlist::Public->new->apply({ input => $hashref, additional_deny_list => [qw( list of fields )] }); |
29 |
|
30 |
Apply an allowlist to input data. |
31 |
|
32 |
=cut |
33 |
|
34 |
sub apply { |
35 |
my ( $self, $params ) = @_; |
36 |
|
37 |
my $input = $params->{input}; |
38 |
my $additional_deny_list = $params->{additional_deny_list} || []; |
39 |
|
40 |
my $blocked = {}; |
41 |
my $ui_fields = $self->{ui_fields}; |
42 |
return unless $ui_fields and %$ui_fields; |
43 |
|
44 |
delete $ui_fields->{$_} for @$additional_deny_list; |
45 |
|
46 |
return unless $input and %$input; |
47 |
|
48 |
my @keys = keys %$input; |
49 |
foreach my $key (@keys){ |
50 |
unless ( exists $ui_fields->{ $key } ) { |
51 |
#NOTE: We capture the deleted data so that it can be used for logging purposes |
52 |
$blocked->{$key} = delete $input->{ $key }; |
53 |
} |
54 |
} |
55 |
|
56 |
if ( %$blocked ) { |
57 |
while ( my ($k, $v)=each %$blocked){ |
58 |
# FIXME We should raise an exception from here |
59 |
my @c = caller; |
60 |
warn sprintf "Forbidden - Tried to modify '%s' with '%s' from %s", $k, $v, "@c"; |
61 |
} |
62 |
} |
63 |
|
64 |
return $blocked; |
65 |
} |
66 |
|
67 |
=head3 get_ui_fields |
68 |
|
69 |
my $ui_fields = $self->get_ui_fields(); |
70 |
my $ui_fields = Koha::Patron::Allowlist::Public->new->get_ui_fields |
71 |
|
72 |
=cut |
73 |
|
74 |
sub get_ui_fields { |
75 |
my ($self) = @_; |
76 |
my @all_fields = $self->_get_all_fields(); |
77 |
my @global_deny_list = $self->_global_deny_list(); |
78 |
my @deny_list = $self->_deny_list(); |
79 |
my @global_allow_list = array_minus @all_fields, @global_deny_list; |
80 |
return array_minus @global_allow_list, @deny_list; |
81 |
} |
82 |
|
4 |
|
83 |
# This must not be replaced by Koha::Patrons->columns |
5 |
# This must not be replaced by Koha::Patrons->columns |
84 |
# We want developper to not forget to adjust it manually and add new attribute to the deny list if needed |
6 |
# We want developper to not forget to adjust it manually and add new attribute to the deny list if needed |
Lines 184-187
sub _global_deny_list {
Link Here
|
184 |
); |
106 |
); |
185 |
} |
107 |
} |
186 |
|
108 |
|
|
|
109 |
sub _deny_list_opac { |
110 |
return qw( |
111 |
dateenrolled |
112 |
dateexpiry |
113 |
gonenoaddress |
114 |
lost |
115 |
borrowernotes |
116 |
relationship |
117 |
opacnote |
118 |
sort1 |
119 |
sort2 |
120 |
sms_provider_id |
121 |
autorenew_checkouts |
122 |
); |
123 |
} |
124 |
|
125 |
sub _deny_list_staff { |
126 |
return qw(); |
127 |
} |
128 |
|
187 |
1; |
129 |
1; |