Attachment #124749 for bug #28948

View | Details | Raw Unified | Return to bug 28948
Collapse All | Expand All




      ->count > 0;
}

=head3 public_read_list

This method returns the list of publically readable database fields for both API and UI output purposes

=cut

sub public_read_list {
    return [
        'branchcode',     'branchname',     'branchaddress1',
        'branchaddress2', 'branchaddress3', 'branchzip',
        'branchcity',     'branchstate',    'branchcountry',
        'branchfax',      'branchemail',    'branchurl'
    ];
}

=head3 to_api_mapping

This method returns the mapping for representing a Koha::Library object




package Koha::Patron::Allowlist;

use Modern::Perl;
use parent 'Koha::Allowlist';

sub load {
    my ($self) = @_;
    my @public_read = qw(
      branchcode     branchname     branchaddress1
      branchaddress2 branchaddress3 branchzip
      branchcity     branchstate    branchcountry
      branchfax      branchemail    branchurl );
    $self->add(@public_read);

    my @staff_read = qw(
      branchillemail branchreplyto branchreturnpath
      branchip       branchnotes   marcorgcode
    );
    $self->add(@staff_read) if $self->{interface} eq 'staff';
}

1;




use Mojo::JSON;
use Scalar::Util qw( blessed looks_like_number );
use Try::Tiny qw( catch try );
use Module::Load::Conditional qw( can_load );

use Koha::Database;
use Koha::Exceptions::Object;

sub to_api {
    my ( $self, $params ) = @_;
    my $json_object = $self->TO_JSON;
    $params //= {};

    # Remove forbidden attributes if required
    # FIXME: All modules should have a corresponding allowlist eventually
    my $allowclass = ref($self) . '::Allowlist';
    if ( can_load( modules => { $allowclass => undef } ) ) {
        my $allowlist = $allowclass->new(
            { interface => $params->{public} ? 'opac' : 'staff' } );
        $allowlist->load;
        my $blocked = $allowlist->apply( { input => $json_object } );
        Koha::Logger->get->debug(
                ref($self)
              . "::to_api allowlist blocked fields: "
              . (
                join ', ',
                map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
              )
        ) if keys %$blocked;
    }

    my $to_api_mapping = $self->to_api_mapping;

Lines 31-36 use Koha::Database; Link Here

(-)a/t/db_dependent/Koha/Object.t (-1 / +3 lines)
31	use Koha::Acquisition::Orders;	31	use Koha::Acquisition::Orders;
32	use Koha::DateUtils qw( dt_from_string );	32	use Koha::DateUtils qw( dt_from_string );
33	use Koha::Libraries;	33	use Koha::Libraries;
		34	use Koha::Library::Allowlist;
34	use Koha::Patrons;	35	use Koha::Patrons;
35	use Koha::ApiKeys;	36	use Koha::ApiKeys;
36		37
Lines 376-382 subtest "to_api() tests" => sub { Link Here
376	subtest 'unprivileged request tests' => sub {	377	subtest 'unprivileged request tests' => sub {
377		378
378	my @all_attrs = Koha::Libraries->columns();	379	my @all_attrs = Koha::Libraries->columns();
379	my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } };	380	my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
		381	my $public_attrs = $allowlist->{_entries};
380	my $mapping = Koha::Library->to_api_mapping;	382	my $mapping = Koha::Library->to_api_mapping;
381		383
382	plan tests => scalar @all_attrs * 2;	384	plan tests => scalar @all_attrs * 2;




use Koha::Patron::Category;
use Koha::Patron::Categories;
use Koha::Patrons;
use Koha::Library::Allowlist;
use Koha::Database;
use Koha::DateUtils qw( dt_from_string );


    subtest 'unprivileged request tests' => sub {

        my @all_attrs = Koha::Libraries->columns();
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
        my $public_attrs = $allowlist->{_entries};
        my $mapping = Koha::Library->to_api_mapping;

        # Create sample libraries
- 

Return to bug 28948

Lines 266-286 sub validate_hold_sibling { Link Here

(-)a/Koha/Library.pm (-15 lines)
266	->count > 0;	266	->count > 0;
267	}	267	}
268		268
269	=head3 public_read_list
270
271	This method returns the list of publically readable database fields for both API and UI output purposes
272
273	=cut
274
275	sub public_read_list {
276	return [
277	'branchcode', 'branchname', 'branchaddress1',
278	'branchaddress2', 'branchaddress3', 'branchzip',
279	'branchcity', 'branchstate', 'branchcountry',
280	'branchfax', 'branchemail', 'branchurl'
281	];
282	}
283
284	=head3 to_api_mapping	269	=head3 to_api_mapping
285		270
286	This method returns the mapping for representing a Koha::Library object	271	This method returns the mapping for representing a Koha::Library object

Lines 24-30 use Carp qw( croak ); Link Here

(-)a/Koha/Object.pm (-8 / +17 lines)
24	use Mojo::JSON;	24	use Mojo::JSON;
25	use Scalar::Util qw( blessed looks_like_number );	25	use Scalar::Util qw( blessed looks_like_number );
26	use Try::Tiny qw( catch try );	26	use Try::Tiny qw( catch try );
27	use List::MoreUtils qw( any );	27	use Module::Load::Conditional qw( can_load );
28		28
29	use Koha::Database;	29	use Koha::Database;
30	use Koha::Exceptions::Object;	30	use Koha::Exceptions::Object;
Lines 552-566 Returns a representation of the object, suitable for API output. Link Here
552	sub to_api {	552	sub to_api {
553	my ( $self, $params ) = @_;	553	my ( $self, $params ) = @_;
554	my $json_object = $self->TO_JSON;	554	my $json_object = $self->TO_JSON;
		555	$params //= {};
555		556
556	# Remove forbidden attributes if required	557	# Remove forbidden attributes if required
557	# FIXME: We should eventually require public_read_list in all objects and drop the conditional here.	558	# FIXME: All modules should have a corresponding allowlist eventually
558	if ( $params->{public}	559	my $allowclass = ref($self) . '::Allowlist';
559	and $self->can('public_read_list') )	560	if ( can_load( modules => { $allowclass => undef } ) ) {
560	{	561	my $allowlist = $allowclass->new(
561	for my $field ( keys %{$json_object} ) {	562	{ interface => $params->{public} ? 'opac' : 'staff' } );
562	delete $json_object->{$field} unless any { $_ eq $field } @{$self->public_read_list};	563	$allowlist->load;
563	}	564	my $blocked = $allowlist->apply( { input => $json_object } );
		565	Koha::Logger->get->debug(
		566	ref($self)
		567	. "::to_api allowlist blocked fields: "
		568	. (
		569	join ', ',
		570	map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
		571	)
		572	) if keys %$blocked;
564	}	573	}
565		574
566	my $to_api_mapping = $self->to_api_mapping;	575	my $to_api_mapping = $self->to_api_mapping;

Line 0 Link Here

(-)a/Koha/Library/Allowlist.pm (+22 lines)
	1	package Koha::Patron::Allowlist;
	2
	3	use Modern::Perl;
	4	use parent 'Koha::Allowlist';
	5
	6	sub load {
	7	my ($self) = @_;
	8	my @public_read = qw(
	9	branchcode branchname branchaddress1
	10	branchaddress2 branchaddress3 branchzip
	11	branchcity branchstate branchcountry
	12	branchfax branchemail branchurl );
	13	$self->add(@public_read);
	14
	15	my @staff_read = qw(
	16	branchillemail branchreplyto branchreturnpath
	17	branchip branchnotes marcorgcode
	18	);
	19	$self->add(@staff_read) if $self->{interface} eq 'staff';
	20	}
	21
	22	1;

Lines 32-37 use Koha::Biblios; Link Here

(-)a/t/db_dependent/Koha/Objects.t (-2 / +3 lines)
32	use Koha::Patron::Category;	32	use Koha::Patron::Category;
33	use Koha::Patron::Categories;	33	use Koha::Patron::Categories;
34	use Koha::Patrons;	34	use Koha::Patrons;
		35	use Koha::Library::Allowlist;
35	use Koha::Database;	36	use Koha::Database;
36	use Koha::DateUtils qw( dt_from_string );	37	use Koha::DateUtils qw( dt_from_string );
37		38
Lines 401-407 subtest "to_api() tests" => sub { Link Here
401	subtest 'unprivileged request tests' => sub {	402	subtest 'unprivileged request tests' => sub {
402		403
403	my @all_attrs = Koha::Libraries->columns();	404	my @all_attrs = Koha::Libraries->columns();
404	my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } };	405	my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
		406	my $public_attrs = $allowlist->{_entries};
405	my $mapping = Koha::Library->to_api_mapping;	407	my $mapping = Koha::Library->to_api_mapping;
406		408
407	# Create sample libraries	409	# Create sample libraries
408	-