View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Query.pm (-2 / +3 lines)
Lines 199-212 Validate operators in the passed query. Link Here
199
    $app->helper(
199
    $app->helper(
200
        'dbic_validate_operators' => sub {
200
        'dbic_validate_operators' => sub {
201
            my ( $c, $args ) = @_;
201
            my ( $c, $args ) = @_;
202
            return try {
202
            try {
203
                _validate_query( $args->{filtered_params} );
203
                _validate_query( $args->{filtered_params} );
204
            } catch {
204
            } catch {
205
                if ( blessed $_ && $_->isa('Koha::Exceptions::BadParameter') ) {
205
                if ( blessed $_ && $_->isa('Koha::Exceptions::BadParameter') ) {
206
                    return $c->render(
206
                    $c->render(
207
                        status  => 400,
207
                        status  => 400,
208
                        json => { error => $_->error }
208
                        json => { error => $_->error }
209
                    );
209
                    );
210
                    Koha::Exceptions::BadParameter->throw( $_->error );
210
                }
211
                }
211
            };
212
            };
212
        }
213
        }
(-)a/t/Koha/REST/Plugin/Query.t (-8 / +18 lines)
Lines 207-219 get '/build_query' => sub { Link Here
207
};
207
};
208
208
209
get '/dbic_validate_operators' => sub {
209
get '/dbic_validate_operators' => sub {
210
    my ( $c, $args ) = @_;
210
    my ( $c ) = @_;
211
211
212
    my $query = $c->req->json->{q};
212
	try {
213
		my $query = $c->req->json->{q};
213
214
214
    $c->dbic_validate_operators({ filtered_params => $query });
215
		$c->dbic_validate_operators({ filtered_params => $query });
215
216
216
    $c->render( json => { filtered_params => $query }, status => 200 );
217
		$c->render( json => { filtered_params => $query }, status => 200 );
218
    }
219
    catch {
220
        $c->render(
221
			status => 400,
222
            json   => { error => "$_" }
223
        );
224
    };
217
};
225
};
218
226
219
get '/stash_embed' => sub {
227
get '/stash_embed' => sub {
Lines 646-652 subtest 'dbic_extended_attributes_join() tests' => sub { Link Here
646
};
654
};
647
655
648
subtest 'dbic_validate_operators' => sub {
656
subtest 'dbic_validate_operators' => sub {
649
    plan tests => 16;
657
    plan tests => 17;
650
658
651
    my $t = Test::Mojo->new;
659
    my $t = Test::Mojo->new;
652
660
Lines 680-685 subtest 'dbic_validate_operators' => sub { Link Here
680
688
681
    # Invalid queries
689
    # Invalid queries
682
    $q = [ { "-and" => [ [ { "biblio_id" => { "like(sleep(1/100000))or" => "%a%" } } ] ] } ];
690
    $q = [ { "-and" => [ [ { "biblio_id" => { "like(sleep(1/100000))or" => "%a%" } } ] ] } ];
683
    $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )->status_is(400);
691
    $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )
684
692
		->status_is(400)
693
		->json_is( '/error' =>
694
			qq{Exception 'Koha::Exceptions::BadParameter' thrown 'Invalid operator in query: like(sleep(1/100000))or'\n}
695
		);
685
};
696
};
686
- 

Return to bug 37018