View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Query.pm (-3 / +13 lines)
Lines 21-26 use Mojo::Base 'Mojolicious::Plugin'; Link Here
21
use List::MoreUtils qw( any );
21
use List::MoreUtils qw( any );
22
use Scalar::Util qw( reftype );
22
use Scalar::Util qw( reftype );
23
use JSON qw( decode_json );
23
use JSON qw( decode_json );
24
use Try::Tiny qw( catch try );
24
25
25
use Koha::Exceptions;
26
use Koha::Exceptions;
26
27
Lines 198-204 Validate operators in the passed query. Link Here
198
    $app->helper(
199
    $app->helper(
199
        'dbic_validate_operators' => sub {
200
        'dbic_validate_operators' => sub {
200
            my ( $c, $args ) = @_;
201
            my ( $c, $args ) = @_;
201
            _validate_query($args->{filtered_params});
202
            return try {
203
                _validate_query( $args->{filtered_params} );
204
            } catch {
205
                if ( blessed $_ && $_->isa('Koha::Exceptions::BadParameter') ) {
206
                    return $c->render(
207
                        status  => 400,
208
                        json => { error => $_->error }
209
                    );
210
                }
211
            };
202
        }
212
        }
203
    );
213
    );
204
214
Lines 663-669 sub _rewrite_related_metadata_query { Link Here
663
sub _validate_operator {
673
sub _validate_operator {
664
    my ($operator) = @_;
674
    my ($operator) = @_;
665
    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
675
    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
666
    die "Invalid operator: $operator" unless exists $allowed_operators{$operator};
676
    Koha::Exceptions::BadParameter->throw(
677
                "Invalid operator in query: $operator") unless exists $allowed_operators{$operator};
667
    return;
678
    return;
668
}
679
}
669
680
670
- 

Return to bug 37018