View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Query.pm (-1 / +67 lines)
Lines 23-28 use Scalar::Util qw( reftype ); Link Here
23
use JSON qw( decode_json );
23
use JSON qw( decode_json );
24
24
25
use Koha::Exceptions;
25
use Koha::Exceptions;
26
use Koha::Exceptions::REST;
26
27
27
=head1 NAME
28
=head1 NAME
28
29
Lines 159-164 Generates the DBIC prefetch attribute based on embedded relations, and merges in Link Here
159
        }
160
        }
160
    );
161
    );
161
162
163
=head3 dbic_validate_operators
164
165
    $attributes = $c->dbic_validate_operators( { filtered_params => $filtered_params } );
166
167
Validate operators in the passed query.
168
169
=cut
170
171
    $app->helper(
172
        'dbic_validate_operators' => sub {
173
            my ( $c, $args ) = @_;
174
            _validate_query( $args->{filtered_params} );
175
        }
176
    );
177
162
=head3 _build_query_params_from_api
178
=head3 _build_query_params_from_api
163
179
164
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
180
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
Lines 489-492 sub _parse_dbic_query { Link Here
489
505
490
}
506
}
491
507
508
=head3 _validate_operator
509
510
=cut
511
512
sub _validate_operator {
513
    my ($operator) = @_;
514
    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
515
    Koha::Exceptions::REST::Query::InvalidOperator->throw( operator => $operator )
516
        unless exists $allowed_operators{$operator};
517
    return;
518
}
519
520
=head3 _validate_query
521
522
=cut
523
524
sub _validate_query {
525
    my ($query) = @_;
526
527
    if ( ref $query eq 'HASH' ) {
528
        for my $field ( keys %$query ) {
529
            my $value = $query->{$field};
530
531
            if ( ref $value eq 'HASH' ) {
532
533
                # Hash reference with operators
534
                for my $operator ( keys %$value ) {
535
                    _validate_operator($operator);
536
                }
537
            } elsif ( ref $value eq 'ARRAY' ) {
538
539
                # Array reference with operator as the first element
540
                _validate_query($value);
541
            } else {
542
543
                # Simple key-value pairs (no operator to validate)
544
            }
545
        }
546
    } elsif ( ref $query eq 'ARRAY' ) {
547
548
        # Top-level OR combination or nested AND combination
549
        for my $element (@$query) {
550
            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
551
                _validate_query( $element->[1] );
552
            } else {
553
                _validate_query($element);
554
            }
555
        }
556
    }
557
}
558
492
1;
559
1;
493
- 

Return to bug 37018