Attachment #124914 for bug #28948

View | Details | Raw Unified | Return to bug 28948
Collapse All | Expand All




package Koha::Patron::Allowlist;

use Modern::Perl;
use parent 'Koha::Allowlist';

sub load {
    my ($self) = @_;
    my @public_read = qw(
      branchcode     branchname     branchaddress1
      branchaddress2 branchaddress3 branchzip
      branchcity     branchstate    branchcountry
      branchfax      branchemail    branchurl );
    $self->add(@public_read);

    my @staff_read = qw(
      branchillemail branchreplyto branchreturnpath
      branchip       branchnotes   marcorgcode
    );
    $self->add(@staff_read) if $self->{interface} eq 'staff';
}

1;




    $params //= {};

    # Remove forbidden attributes if required
    if( $self->_result->can('get_column_set') ) { #FIXME Temporary measure
        my $set_name = $params->{public} ? 'public_read' : 'staff_read';
        $json_object = $self->filter({ input => $json_object, column_set => $set_name, log_level => 'debug' });
        my $allowlist = $allowclass->new(
            { interface => $params->{public} ? 'opac' : 'staff' } );
        $allowlist->load;
        my $blocked = $allowlist->apply( { input => $json_object } );
        Koha::Logger->get->debug(
                ref($self)
              . "::to_api allowlist blocked fields: "
              . (
                join ', ',
                map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
              )
        ) if keys %$blocked;
    }

    my $to_api_mapping = $self->to_api_mapping;




    'Koha::Libraries';
}

sub get_column_set {
    my ( $self, $name ) = @_;
    my $column_sets = {
        public_read => [qw(
            branchcode     branchname     branchaddress1
            branchaddress2 branchaddress3 branchzip
            branchcity     branchstate    branchcountry
            branchfax      branchemail    branchurl
        )],
        staff_read => [qw(
            branchcode     branchname     branchaddress1
            branchaddress2 branchaddress3 branchzip
            branchcity     branchstate    branchcountry
            branchfax      branchemail    branchurl
            branchillemail branchreplyto  branchreturnpath
            branchip       branchnotes    marcorgcode
        )],
    };
    return $column_sets->{$name} // [];
}

1;




use Koha::Acquisition::Orders;
use Koha::DateUtils qw( dt_from_string );
use Koha::Libraries;
use Koha::Object::ColumnSet;
use Koha::Patrons;
use Koha::ApiKeys;



    subtest 'unprivileged request tests' => sub {

        # Create a sample library
        my $library = $builder->build_object({ class => 'Koha::Libraries' });

        my @all_attrs = @{ $library->_columns };
        my $public_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('public_read')} };
        my $staff_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('staff_read')} };
        my $mapping = Koha::Library->to_api_mapping;

        plan tests => scalar @all_attrs * 2;

        my $public_representation = $library->to_api({ public => 1 });
        my $library = $builder->build_object( { class => 'Koha::Libraries' } );

        my $unprivileged_representation = $library->to_api({ public => 1 });
        my $privileged_representation   = $library->to_api;

        foreach my $attr (@all_attrs) {
            my $mapped = $mapping->{$attr} // $attr;
            is( exists $privileged_representation->{$mapped},
                exists $staff_attrs->{$attr}, "Verify $attr in privileged" );
            is( exists $public_representation->{$mapped},
                exists $public_attrs->{$attr}, "Verify $attr in public" );
                );
                if ( exists $public_attrs->{$attr} ) {
                    ok(
                        exists $unprivileged_representation->{$mapped},
                        "Attribute '$attr' is present when public"
                    );
                }
                else {
                    ok(
                        !exists $unprivileged_representation->{$mapped},
                        "Attribute '$attr' is not present when public"
                    );
                }
            }
            else {
                ok(
                    !exists $privileged_representation->{$attr},
                    "Unmapped attribute '$attr' is not present when privileged"
                );
                ok(
                    !exists $unprivileged_representation->{$attr},
                    "Unmapped attribute '$attr' is not present when public"
                );
            }
        }
    };





use Koha::Patron::Category;
use Koha::Patron::Categories;
use Koha::Patrons;
use Koha::Library::Allowlist;
use Koha::Database;
use Koha::DateUtils qw( dt_from_string );


    }

    subtest 'unprivileged request tests' => sub {
        plan tests => 4;
        my @all_attrs = Koha::Libraries->columns();
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
        my $public_attrs = $allowlist->{_entries};
        my $mapping = Koha::Library->to_api_mapping;

        # Create sample libraries
        my $library_1 = $builder->build_object({ class => 'Koha::Libraries' });
        my $library_2 = $builder->build_object({ class => 'Koha::Libraries' });
        my $libraries = Koha::Libraries->search({
            branchcode => [ $library_1->branchcode, $library_2->branchcode ],
        });
                    '-in' => [
                        $library_1->branchcode, $library_2->branchcode
                    ]
                }
            }
        );

        plan tests => scalar @all_attrs * 2 * $libraries->count;

        my $libraries_unprivileged_representation = $libraries->to_api({ public => 1 });
        my $libraries_privileged_representation   = $libraries->to_api();
        my $mapping = Koha::Library->to_api_mapping;

        my $public_attrs = [ sort map { $mapping->{$_} //$_ } @{$library_1->_result->get_column_set('public_read')} ];
        is_deeply( [ sort keys %{$libraries_unprivileged_representation->[0]} ], $public_attrs, 'Check first, public' );
        is_deeply( [ sort keys %{$libraries_unprivileged_representation->[1]} ], $public_attrs, 'Check second, public' );
            foreach my $attr (@all_attrs) {
                my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;
                if ( defined($mapped) ) {
                    ok(
                        exists $privileged_representation->{$mapped},
                        "Attribute '$attr' is present when privileged"
                    );
                    if ( exists $public_attrs->{$attr} ) {
                        ok(
                            exists $unprivileged_representation->{$mapped},
                            "Attribute '$attr' is present when public"
                        );
                    }
                    else {
                        ok(
                            !exists $unprivileged_representation->{$mapped},
                            "Attribute '$attr' is not present when public"
                        );
                    }
                }
                else {
                    ok(
                        !exists $privileged_representation->{$attr},
                        "Unmapped attribute '$attr' is not present when privileged"
                    );
                    ok(
                        !exists $unprivileged_representation->{$attr},
                        "Unmapped attribute '$attr' is not present when public"
                    );
                }
            }
        }
    };

        my $staff_attrs = [ sort map { $mapping->{$_} //$_ } @{$library_1->_result->get_column_set('staff_read')} ];
        is_deeply( [ sort keys %{$libraries_privileged_representation->[0]} ], $staff_attrs, 'Check first, staff' );
        is_deeply( [ sort keys %{$libraries_privileged_representation->[1]} ], $staff_attrs, 'Check second, staff' );
    };

    $schema->storage->txn_rollback;
};
- 

Return to bug 28948

Lines 556-576 sub to_api { Link Here

(-)a/Koha/Object.pm (-15 / +3 lines)
556	$params //= {};	556	$params //= {};
557		557
558	# Remove forbidden attributes if required	558	# Remove forbidden attributes if required
559	# FIXME: All modules should have a corresponding allowlist eventually	559	if( $self->_result->can('get_column_set') ) { #FIXME Temporary measure
560	my $allowclass = ref($self) . '::Allowlist';	560	my $set_name = $params->{public} ? 'public_read' : 'staff_read';
561	if ( can_load( modules => { $allowclass => undef } ) ) {	561	$json_object = $self->filter({ input => $json_object, column_set => $set_name, log_level => 'debug' });
562	my $allowlist = $allowclass->new(
563	{ interface => $params->{public} ? 'opac' : 'staff' } );
564	$allowlist->load;
565	my $blocked = $allowlist->apply( { input => $json_object } );
566	Koha::Logger->get->debug(
567	ref($self)
568	. "::to_api allowlist blocked fields: "
569	. (
570	join ', ',
571	map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
572	)
573	) if keys %$blocked;
574	}	562	}
575		563
576	my $to_api_mapping = $self->to_api_mapping;	564	my $to_api_mapping = $self->to_api_mapping;

Lines 901-904 sub koha_objects_class { Link Here

(-)a/Koha/Schema/Result/Branch.pm (+21 lines)
901	'Koha::Libraries';	901	'Koha::Libraries';
902	}	902	}
903		903
		904	sub get_column_set {
		905	my ( $self, $name ) = @_;
		906	my $column_sets = {
		907	public_read => [qw(
		908	branchcode branchname branchaddress1
		909	branchaddress2 branchaddress3 branchzip
		910	branchcity branchstate branchcountry
		911	branchfax branchemail branchurl
		912	)],
		913	staff_read => [qw(
		914	branchcode branchname branchaddress1
		915	branchaddress2 branchaddress3 branchzip
		916	branchcity branchstate branchcountry
		917	branchfax branchemail branchurl
		918	branchillemail branchreplyto branchreturnpath
		919	branchip branchnotes marcorgcode
		920	)],
		921	};
		922	return $column_sets->{$name} // [];
		923	}
		924
904	1;	925	1;

Lines 31-37 use Koha::Database; Link Here

(-)a/t/db_dependent/Koha/Object.t (-37 / +13 lines)
31	use Koha::Acquisition::Orders;	31	use Koha::Acquisition::Orders;
32	use Koha::DateUtils qw( dt_from_string );	32	use Koha::DateUtils qw( dt_from_string );
33	use Koha::Libraries;	33	use Koha::Libraries;
34	use Koha::Library::Allowlist;	34	use Koha::Object::ColumnSet;
35	use Koha::Patrons;	35	use Koha::Patrons;
36	use Koha::ApiKeys;	36	use Koha::ApiKeys;
37		37
Lines 376-424 subtest "to_api() tests" => sub { Link Here
376		376
377	subtest 'unprivileged request tests' => sub {	377	subtest 'unprivileged request tests' => sub {
378		378
379	my @all_attrs = Koha::Libraries->columns();	379	# Create a sample library
380	my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();	380	my $library = $builder->build_object({ class => 'Koha::Libraries' });
381	my $public_attrs = $allowlist->{_entries};	381
		382	my @all_attrs = @{ $library->_columns };
		383	my $public_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('public_read')} };
		384	my $staff_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('staff_read')} };
382	my $mapping = Koha::Library->to_api_mapping;	385	my $mapping = Koha::Library->to_api_mapping;
383		386
384	plan tests => scalar @all_attrs * 2;	387	plan tests => scalar @all_attrs * 2;
385		388
386	# Create a sample library	389	my $public_representation = $library->to_api({ public => 1 });
387	my $library = $builder->build_object( { class => 'Koha::Libraries' } );
388
389	my $unprivileged_representation = $library->to_api({ public => 1 });
390	my $privileged_representation = $library->to_api;	390	my $privileged_representation = $library->to_api;
391		391
392	foreach my $attr (@all_attrs) {	392	foreach my $attr (@all_attrs) {
393	my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;	393	my $mapped = $mapping->{$attr} // $attr;
394	if ( defined($mapped) ) {	394	is( exists $privileged_representation->{$mapped},
395	ok(	395	exists $staff_attrs->{$attr}, "Verify $attr in privileged" );
396	exists $privileged_representation->{$mapped},	396	is( exists $public_representation->{$mapped},
397	"Attribute '$attr' is present when privileged"	397	exists $public_attrs->{$attr}, "Verify $attr in public" );
398	);
399	if ( exists $public_attrs->{$attr} ) {
400	ok(
401	exists $unprivileged_representation->{$mapped},
402	"Attribute '$attr' is present when public"
403	);
404	}
405	else {
406	ok(
407	!exists $unprivileged_representation->{$mapped},
408	"Attribute '$attr' is not present when public"
409	);
410	}
411	}
412	else {
413	ok(
414	!exists $privileged_representation->{$attr},
415	"Unmapped attribute '$attr' is not present when privileged"
416	);
417	ok(
418	!exists $unprivileged_representation->{$attr},
419	"Unmapped attribute '$attr' is not present when public"
420	);
421	}
422	}	398	}
423	};	399	};
424		400

Lines 32-38 use Koha::Biblios; Link Here

(-)a/t/db_dependent/Koha/Objects.t (-54 / +12 lines)
32	use Koha::Patron::Category;	32	use Koha::Patron::Category;
33	use Koha::Patron::Categories;	33	use Koha::Patron::Categories;
34	use Koha::Patrons;	34	use Koha::Patrons;
35	use Koha::Library::Allowlist;
36	use Koha::Database;	35	use Koha::Database;
37	use Koha::DateUtils qw( dt_from_string );	36	use Koha::DateUtils qw( dt_from_string );
38		37
Lines 400-466 subtest "to_api() tests" => sub { Link Here
400	}	399	}
401		400
402	subtest 'unprivileged request tests' => sub {	401	subtest 'unprivileged request tests' => sub {
403		402	plan tests => 4;
404	my @all_attrs = Koha::Libraries->columns();
405	my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
406	my $public_attrs = $allowlist->{_entries};
407	my $mapping = Koha::Library->to_api_mapping;
408		403
409	# Create sample libraries	404	# Create sample libraries
410	my $library_1 = $builder->build_object({ class => 'Koha::Libraries' });	405	my $library_1 = $builder->build_object({ class => 'Koha::Libraries' });
411	my $library_2 = $builder->build_object({ class => 'Koha::Libraries' });	406	my $library_2 = $builder->build_object({ class => 'Koha::Libraries' });
412	my $libraries = Koha::Libraries->search(	407	my $libraries = Koha::Libraries->search({
413	{	408	branchcode => [ $library_1->branchcode, $library_2->branchcode ],
414	branchcode => {	409	});
415	'-in' => [
416	$library_1->branchcode, $library_2->branchcode
417	]
418	}
419	}
420	);
421
422	plan tests => scalar @all_attrs * 2 * $libraries->count;
423		410
424	my $libraries_unprivileged_representation = $libraries->to_api({ public => 1 });	411	my $libraries_unprivileged_representation = $libraries->to_api({ public => 1 });
425	my $libraries_privileged_representation = $libraries->to_api();	412	my $libraries_privileged_representation = $libraries->to_api();
		413	my $mapping = Koha::Library->to_api_mapping;
426		414
427	for (my $i = 0; $i < $libraries->count; $i++) {	415	my $public_attrs = [ sort map { $mapping->{$_} //$_ } @{$library_1->_result->get_column_set('public_read')} ];
428	my $privileged_representation = $libraries_privileged_representation->[$i];	416	is_deeply( [ sort keys %{$libraries_unprivileged_representation->[0]} ], $public_attrs, 'Check first, public' );
429	my $unprivileged_representation = $libraries_unprivileged_representation->[$i];	417	is_deeply( [ sort keys %{$libraries_unprivileged_representation->[1]} ], $public_attrs, 'Check second, public' );
430	foreach my $attr (@all_attrs) {
431	my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;
432	if ( defined($mapped) ) {
433	ok(
434	exists $privileged_representation->{$mapped},
435	"Attribute '$attr' is present when privileged"
436	);
437	if ( exists $public_attrs->{$attr} ) {
438	ok(
439	exists $unprivileged_representation->{$mapped},
440	"Attribute '$attr' is present when public"
441	);
442	}
443	else {
444	ok(
445	!exists $unprivileged_representation->{$mapped},
446	"Attribute '$attr' is not present when public"
447	);
448	}
449	}
450	else {
451	ok(
452	!exists $privileged_representation->{$attr},
453	"Unmapped attribute '$attr' is not present when privileged"
454	);
455	ok(
456	!exists $unprivileged_representation->{$attr},
457	"Unmapped attribute '$attr' is not present when public"
458	);
459	}
460	}
461	}
462	};
463		418
		419	my $staff_attrs = [ sort map { $mapping->{$_} //$_ } @{$library_1->_result->get_column_set('staff_read')} ];
		420	is_deeply( [ sort keys %{$libraries_privileged_representation->[0]} ], $staff_attrs, 'Check first, staff' );
		421	is_deeply( [ sort keys %{$libraries_privileged_representation->[1]} ], $staff_attrs, 'Check second, staff' );
		422	};
464		423
465	$schema->storage->txn_rollback;	424	$schema->storage->txn_rollback;
466	};	425	};
467	-

Lines 1-22 Link Here

(-)a/Koha/Library/Allowlist.pm (-22 lines)
1	package Koha::Patron::Allowlist;
2
3	use Modern::Perl;
4	use parent 'Koha::Allowlist';
5
6	sub load {
7	my ($self) = @_;
8	my @public_read = qw(
9	branchcode branchname branchaddress1
10	branchaddress2 branchaddress3 branchzip
11	branchcity branchstate branchcountry
12	branchfax branchemail branchurl );
13	$self->add(@public_read);
14
15	my @staff_read = qw(
16	branchillemail branchreplyto branchreturnpath
17	branchip branchnotes marcorgcode
18	);
19	$self->add(@staff_read) if $self->{interface} eq 'staff';
20	}
21
22	1;