View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Query.pm (-1 / +67 lines)
Lines 23-28 use Scalar::Util qw( reftype ); Link Here
23
use JSON qw( decode_json );
23
use JSON qw( decode_json );
24
24
25
use Koha::Exceptions;
25
use Koha::Exceptions;
26
use Koha::Exceptions::REST;
26
27
27
=head1 NAME
28
=head1 NAME
28
29
Lines 187-192 Generates the DBIC join attribute based on extended_attributes query entries, an Link Here
187
        }
188
        }
188
    );
189
    );
189
190
191
=head3 dbic_validate_operators
192
193
    $attributes = $c->dbic_validate_operators( { filtered_params => $filtered_params } );
194
195
Validate operators in the passed query.
196
197
=cut
198
199
    $app->helper(
200
        'dbic_validate_operators' => sub {
201
            my ( $c, $args ) = @_;
202
            _validate_query( $args->{filtered_params} );
203
        }
204
    );
205
190
=head3 _build_query_params_from_api
206
=head3 _build_query_params_from_api
191
207
192
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
208
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
Lines 641-644 sub _rewrite_related_metadata_query { Link Here
641
    return $extended_attributes_entries;
657
    return $extended_attributes_entries;
642
}
658
}
643
659
660
=head3 _validate_operator
661
662
=cut
663
664
sub _validate_operator {
665
    my ($operator) = @_;
666
    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
667
    Koha::Exceptions::REST::Query::InvalidOperator->throw( operator => $operator )
668
        unless exists $allowed_operators{$operator};
669
    return;
670
}
671
672
=head3 _validate_query
673
674
=cut
675
676
sub _validate_query {
677
    my ($query) = @_;
678
679
    if ( ref $query eq 'HASH' ) {
680
        for my $field ( keys %$query ) {
681
            my $value = $query->{$field};
682
683
            if ( ref $value eq 'HASH' ) {
684
685
                # Hash reference with operators
686
                for my $operator ( keys %$value ) {
687
                    _validate_operator($operator);
688
                }
689
            } elsif ( ref $value eq 'ARRAY' ) {
690
691
                # Array reference with operator as the first element
692
                _validate_query($value);
693
            } else {
694
695
                # Simple key-value pairs (no operator to validate)
696
            }
697
        }
698
    } elsif ( ref $query eq 'ARRAY' ) {
699
700
        # Top-level OR combination or nested AND combination
701
        for my $element (@$query) {
702
            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
703
                _validate_query( $element->[1] );
704
            } else {
705
                _validate_query($element);
706
            }
707
        }
708
    }
709
}
710
644
1;
711
1;
645
- 

Return to bug 37018