Attachment #124911 for bug #28948

View | Details | Raw Unified | Return to bug 28948
Collapse All | Expand All




package Koha::Patron::Allowlist;

use Modern::Perl;
use parent 'Koha::Allowlist';

sub load {
    my ($self) = @_;
    my @public_read = qw(
      branchcode     branchname     branchaddress1
      branchaddress2 branchaddress3 branchzip
      branchcity     branchstate    branchcountry
      branchfax      branchemail    branchurl );
    $self->add(@public_read);

    my @staff_read = qw(
      branchillemail branchreplyto branchreturnpath
      branchip       branchnotes   marcorgcode
    );
    $self->add(@staff_read) if $self->{interface} eq 'staff';
}

1;




    $params //= {};

    # Remove forbidden attributes if required
    if( $self->_result->can('get_column_set') ) { #FIXME Temporary measure
        my $set_name = $params->{public} ? 'public_read' : 'staff_read';
        $json_object = $self->filter({ input => $json_object, column_set => $set_name, log_level => 'debug' });
        my $allowlist = $allowclass->new(
            { interface => $params->{public} ? 'opac' : 'staff' } );
        $allowlist->load;
        my $blocked = $allowlist->apply( { input => $json_object } );
        Koha::Logger->get->debug(
                ref($self)
              . "::to_api allowlist blocked fields: "
              . (
                join ', ',
                map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
              )
        ) if keys %$blocked;
    }

    my $to_api_mapping = $self->to_api_mapping;




    'Koha::Libraries';
}

sub get_column_set {
    my ( $self, $name ) = @_;
    my $column_sets = {
        public_read => [qw(
            branchcode     branchname     branchaddress1
            branchaddress2 branchaddress3 branchzip
            branchcity     branchstate    branchcountry
            branchfax      branchemail    branchurl
        )],
        staff_read => [qw(
            branchcode     branchname     branchaddress1
            branchaddress2 branchaddress3 branchzip
            branchcity     branchstate    branchcountry
            branchfax      branchemail    branchurl
            branchillemail branchreplyto  branchreturnpath
            branchip       branchnotes    marcorgcode
        )],
    };
    return $column_sets->{$name} // [];
}

1;




use Koha::Acquisition::Orders;
use Koha::DateUtils qw( dt_from_string );
use Koha::Libraries;
use Koha::Object::ColumnSet;
use Koha::Patrons;
use Koha::ApiKeys;



    subtest 'unprivileged request tests' => sub {

        # Create a sample library
        my $library = $builder->build_object({ class => 'Koha::Libraries' });

        my @all_attrs = @{ $library->_columns };
        my $public_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('public_read')} };
        my $staff_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('staff_read')} };
        my $mapping = Koha::Library->to_api_mapping;

        plan tests => scalar @all_attrs * 2;

        my $public_representation = $library->to_api({ public => 1 });
        my $library = $builder->build_object( { class => 'Koha::Libraries' } );

        my $unprivileged_representation = $library->to_api({ public => 1 });
        my $privileged_representation   = $library->to_api;

        foreach my $attr (@all_attrs) {
            my $mapped = $mapping->{$attr} // $attr;
            is( exists $privileged_representation->{$mapped},
                exists $staff_attrs->{$attr}, "Verify $attr in privileged" );
            is( exists $public_representation->{$mapped},
                exists $public_attrs->{$attr}, "Verify $attr in public" );
                );
                if ( exists $public_attrs->{$attr} ) {
                    ok(
                        exists $unprivileged_representation->{$mapped},
                        "Attribute '$attr' is present when public"
                    );
                }
                else {
                    ok(
                        !exists $unprivileged_representation->{$mapped},
                        "Attribute '$attr' is not present when public"
                    );
                }
            }
            else {
                ok(
                    !exists $privileged_representation->{$attr},
                    "Unmapped attribute '$attr' is not present when privileged"
                );
                ok(
                    !exists $unprivileged_representation->{$attr},
                    "Unmapped attribute '$attr' is not present when public"
                );
            }
        }
    };

- 

Return to bug 28948

Lines 556-576 sub to_api { Link Here

(-)a/Koha/Object.pm (-15 / +3 lines)
556	$params //= {};	556	$params //= {};
557		557
558	# Remove forbidden attributes if required	558	# Remove forbidden attributes if required
559	# FIXME: All modules should have a corresponding allowlist eventually	559	if( $self->_result->can('get_column_set') ) { #FIXME Temporary measure
560	my $allowclass = ref($self) . '::Allowlist';	560	my $set_name = $params->{public} ? 'public_read' : 'staff_read';
561	if ( can_load( modules => { $allowclass => undef } ) ) {	561	$json_object = $self->filter({ input => $json_object, column_set => $set_name, log_level => 'debug' });
562	my $allowlist = $allowclass->new(
563	{ interface => $params->{public} ? 'opac' : 'staff' } );
564	$allowlist->load;
565	my $blocked = $allowlist->apply( { input => $json_object } );
566	Koha::Logger->get->debug(
567	ref($self)
568	. "::to_api allowlist blocked fields: "
569	. (
570	join ', ',
571	map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
572	)
573	) if keys %$blocked;
574	}	562	}
575		563
576	my $to_api_mapping = $self->to_api_mapping;	564	my $to_api_mapping = $self->to_api_mapping;

Lines 901-904 sub koha_objects_class { Link Here

(-)a/Koha/Schema/Result/Branch.pm (+21 lines)
901	'Koha::Libraries';	901	'Koha::Libraries';
902	}	902	}
903		903
		904	sub get_column_set {
		905	my ( $self, $name ) = @_;
		906	my $column_sets = {
		907	public_read => [qw(
		908	branchcode branchname branchaddress1
		909	branchaddress2 branchaddress3 branchzip
		910	branchcity branchstate branchcountry
		911	branchfax branchemail branchurl
		912	)],
		913	staff_read => [qw(
		914	branchcode branchname branchaddress1
		915	branchaddress2 branchaddress3 branchzip
		916	branchcity branchstate branchcountry
		917	branchfax branchemail branchurl
		918	branchillemail branchreplyto branchreturnpath
		919	branchip branchnotes marcorgcode
		920	)],
		921	};
		922	return $column_sets->{$name} // [];
		923	}
		924
904	1;	925	1;

Lines 31-37 use Koha::Database; Link Here

(-)a/t/db_dependent/Koha/Object.t (-38 / +13 lines)
31	use Koha::Acquisition::Orders;	31	use Koha::Acquisition::Orders;
32	use Koha::DateUtils qw( dt_from_string );	32	use Koha::DateUtils qw( dt_from_string );
33	use Koha::Libraries;	33	use Koha::Libraries;
34	use Koha::Library::Allowlist;	34	use Koha::Object::ColumnSet;
35	use Koha::Patrons;	35	use Koha::Patrons;
36	use Koha::ApiKeys;	36	use Koha::ApiKeys;
37		37
Lines 376-424 subtest "to_api() tests" => sub { Link Here
376		376
377	subtest 'unprivileged request tests' => sub {	377	subtest 'unprivileged request tests' => sub {
378		378
379	my @all_attrs = Koha::Libraries->columns();	379	# Create a sample library
380	my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();	380	my $library = $builder->build_object({ class => 'Koha::Libraries' });
381	my $public_attrs = $allowlist->{_entries};	381
		382	my @all_attrs = @{ $library->_columns };
		383	my $public_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('public_read')} };
		384	my $staff_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('staff_read')} };
382	my $mapping = Koha::Library->to_api_mapping;	385	my $mapping = Koha::Library->to_api_mapping;
383		386
384	plan tests => scalar @all_attrs * 2;	387	plan tests => scalar @all_attrs * 2;
385		388
386	# Create a sample library	389	my $public_representation = $library->to_api({ public => 1 });
387	my $library = $builder->build_object( { class => 'Koha::Libraries' } );
388
389	my $unprivileged_representation = $library->to_api({ public => 1 });
390	my $privileged_representation = $library->to_api;	390	my $privileged_representation = $library->to_api;
391		391
392	foreach my $attr (@all_attrs) {	392	foreach my $attr (@all_attrs) {
393	my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;	393	my $mapped = $mapping->{$attr} // $attr;
394	if ( defined($mapped) ) {	394	is( exists $privileged_representation->{$mapped},
395	ok(	395	exists $staff_attrs->{$attr}, "Verify $attr in privileged" );
396	exists $privileged_representation->{$mapped},	396	is( exists $public_representation->{$mapped},
397	"Attribute '$attr' is present when privileged"	397	exists $public_attrs->{$attr}, "Verify $attr in public" );
398	);
399	if ( exists $public_attrs->{$attr} ) {
400	ok(
401	exists $unprivileged_representation->{$mapped},
402	"Attribute '$attr' is present when public"
403	);
404	}
405	else {
406	ok(
407	!exists $unprivileged_representation->{$mapped},
408	"Attribute '$attr' is not present when public"
409	);
410	}
411	}
412	else {
413	ok(
414	!exists $privileged_representation->{$attr},
415	"Unmapped attribute '$attr' is not present when privileged"
416	);
417	ok(
418	!exists $unprivileged_representation->{$attr},
419	"Unmapped attribute '$attr' is not present when public"
420	);
421	}
422	}	398	}
423	};	399	};
424		400
425	-

Lines 1-22 Link Here

(-)a/Koha/Library/Allowlist.pm (-22 lines)
1	package Koha::Patron::Allowlist;
2
3	use Modern::Perl;
4	use parent 'Koha::Allowlist';
5
6	sub load {
7	my ($self) = @_;
8	my @public_read = qw(
9	branchcode branchname branchaddress1
10	branchaddress2 branchaddress3 branchzip
11	branchcity branchstate branchcountry
12	branchfax branchemail branchurl );
13	$self->add(@public_read);
14
15	my @staff_read = qw(
16	branchillemail branchreplyto branchreturnpath
17	branchip branchnotes marcorgcode
18	);
19	$self->add(@staff_read) if $self->{interface} eq 'staff';
20	}
21
22	1;