View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Objects.pm (-1 / +3 lines)
Lines 295-301 controller, and thus shouldn't be called twice in it. Link Here
295
                }
295
                }
296
            );
296
            );
297
297
298
            $c->dbic_validate_operators({ filtered_params => $filtered_params});
298
            if ( $c->dbic_validate_operators( { filtered_params => $filtered_params } ) ) {
299
                $filtered_params = $c->dbic_remove_invalid_operators( { filtered_params => $filtered_params } );
300
            }
299
301
300
            # Generate the resultset
302
            # Generate the resultset
301
            my $objects_rs = $result_set->search( $filtered_params, $attributes );
303
            my $objects_rs = $result_set->search( $filtered_params, $attributes );
(-)a/Koha/REST/Plugin/Query.pm (+76 lines)
Lines 212-217 Validate operators in the passed query. Link Here
212
        }
212
        }
213
    );
213
    );
214
214
215
=head3 dbic_validate_operators
216
217
    $filtered_params = $c->dbic_remove_invalid_operators({ filtered_params => $filtered_params});
218
219
Remove invalid operators from query
220
221
=cut
222
223
$app->helper(
224
    'dbic_remove_invalid_operators' => sub {
225
        my ( $c, $args ) = @_;
226
        my @invalid_operators = _get_invalid_operators( $args->{filtered_params} );
227
        my %badoperators      = map { $_ => 1 } @invalid_operators;
228
        my $filtered_params   = _remove_invalid_operators( $args->{filtered_params}, %badoperators );
229
        return $filtered_params;
230
    }
231
);
232
215
=head3 _build_query_params_from_api
233
=head3 _build_query_params_from_api
216
234
217
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
235
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
Lines 717-720 sub _validate_query { Link Here
717
    }
735
    }
718
}
736
}
719
737
738
my @invalid_operators;
739
740
sub _get_invalid_operators {
741
    my ($query) = @_;
742
    if ( ref $query eq 'HASH' ) {
743
744
        for my $field ( keys %$query ) {
745
            my $value = $query->{$field};
746
            if ( ref $value eq 'HASH' ) {
747
748
                # Hash reference with operators
749
                my %allowed_operators =
750
                    map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
751
                for my $operator ( keys %$value ) {
752
                    push( @invalid_operators, $operator ) unless exists $allowed_operators{$operator};
753
                }
754
            } elsif ( ref $value eq 'ARRAY' ) {
755
756
                # Array reference with operator as the first element
757
                _get_invalid_operators($value);
758
            } else {
759
760
                # Simple key-value pairs (no operator to validate)
761
            }
762
        }
763
    } elsif ( ref $query eq 'ARRAY' ) {
764
765
        # Top-level OR combination or nested AND combination
766
        for my $element (@$query) {
767
            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
768
                _get_invalid_operators( $element->[1] );
769
            } else {
770
                _get_invalid_operators($element);
771
            }
772
        }
773
    }
774
    return @invalid_operators;
775
}
776
777
sub _remove_invalid_operators {
778
    my ( $q_params, %badoperators ) = @_;
779
    if ( reftype($q_params) && reftype($q_params) eq 'HASH' ) {
780
        my $parsed_hash;
781
        foreach my $key ( keys %{$q_params} ) {
782
            if ( exists( $badoperators{$key} ) ) {
783
                $key = '';
784
            }
785
            $parsed_hash->{$key} = _remove_invalid_operators( $q_params->{$key}, %badoperators );
786
        }
787
        return $parsed_hash;
788
    } elsif ( reftype($q_params) && reftype($q_params) eq 'ARRAY' ) {
789
        my @mapped = map { _remove_invalid_operators( $_, %badoperators ) } @$q_params;
790
        return \@mapped;
791
    } else {
792
        return $q_params;
793
    }
794
}
795
720
1;
796
1;
(-)a/t/Koha/REST/Plugin/Query.t (-2 / +30 lines)
Lines 216-221 get '/dbic_validate_operators' => sub { Link Here
216
    $c->render( json => { filtered_params => $query }, status => 200 );
216
    $c->render( json => { filtered_params => $query }, status => 200 );
217
};
217
};
218
218
219
get '/dbic_remove_invalid_operators' => sub {
220
    my ( $c, $args ) = @_;
221
222
    my $query = $c->req->json->{q};
223
224
    $c->dbic_validate_operators({ filtered_params => $query });
225
226
    $c->render( json => { filtered_params => $query }, status => 200 );
227
};
228
229
#get '/merge_q_params' => sub {
230
  #my $c = shift;
231
  #my $filtered_params = {'biblio_id' => 1};
232
  #my $result_set = Koha::Biblios->new;
233
  #$filtered_params = $c->merge_q_params($filtered_params, $c->req->json->{q}, $result_set);
234
#
235
  #$c->render( json => $filtered_params, status => 200 );
236
#};
237
219
get '/stash_embed' => sub {
238
get '/stash_embed' => sub {
220
    my $c = shift;
239
    my $c = shift;
221
240
Lines 347-353 sub to_model { Link Here
347
366
348
# The tests
367
# The tests
349
368
350
use Test::More tests => 9;
369
use Test::More tests => 10;
351
use Test::Mojo;
370
use Test::Mojo;
352
371
353
subtest 'extract_reserved_params() tests' => sub {
372
subtest 'extract_reserved_params() tests' => sub {
Lines 683-685 subtest 'dbic_validate_operators' => sub { Link Here
683
    $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )->status_is(400);
702
    $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )->status_is(400);
684
703
685
};
704
};
686
- 
705
706
subtest 'dbic_remove_invalid_operators' => sub {
707
    plan tests => 2;
708
709
    my $t = Test::Mojo->new;
710
711
    my $q = [ { "-and" => [ [ { "biblio_id" => { "like(sleep(1/100000))or" => "%a%" } } ] ] } ];
712
    $t->get_ok( '/dbic_remove_invalid_operators' => json => { q => $q } )->status_is(200);
713
714
};

Return to bug 37018