View | Details | Raw Unified | Return to bug 37041
Collapse All | Expand All

(-)a/C4/Auth.pm (+37 lines)
Lines 2392-2397 sub getborrowernumber { Link Here
2392
    return 0;
2392
    return 0;
2393
}
2393
}
2394
2394
2395
=head2 check_value_builder_caller
2396
2397
    C4::Auth::check_value_builder_caller();
2398
    my $check = C4::Auth::check_value_builder_caller{ { exit => 0 } );
2399
2400
    A value builder plugin should be called (with do $file) from
2401
    Koha::FrameworkPlugin. (Used by plugin_launcher, form builders,
2402
    a.o.) In that case we will return 1.
2403
    In all other case like someone trying to hit a value builder plugin
2404
    directly, we may return false or exit with a 403 immediately (based
2405
    on the exit parameter).
2406
2407
    NOTE: If exit is not passed, it defaults to 1!
2408
2409
=cut
2410
2411
sub check_value_builder_caller {
2412
    my ($params) = @_;
2413
    my $exit = $params->{exit} // 1;
2414
2415
    my $callers;
2416
    $callers->[0] = [ caller(0) ];
2417
    if ( $callers->[0]->[1] =~ /\/cataloguing\/value_builder\// ) {
2418
2419
        # Need to check call stack
2420
        $callers->[1] = [ caller(1) ];
2421
        return 1 if $callers->[1]->[1] =~ /\/Koha\/FrameworkPlugin\.pm$/;
2422
    }
2423
2424
    if ($exit) {
2425
        require CGI;
2426
        print CGI->new->header( -type => 'text/plain', -status => '403 Forbidden' );
2427
        safe_exit;
2428
    }
2429
    return;
2430
}
2431
2395
END { }    # module clean-up code here (global destructor)
2432
END { }    # module clean-up code here (global destructor)
2396
1;
2433
1;
2397
__END__
2434
__END__
(-)a/xt/find-missing-auth_checks.t (-2 / +4 lines)
Lines 32-38 FILE: foreach my $file (@files) { Link Here
32
    chomp $file;
32
    chomp $file;
33
    my @lines = read_file($file);
33
    my @lines = read_file($file);
34
    for my $line (@lines) {
34
    for my $line (@lines) {
35
        for my $routine (qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init )) {
35
        for my $routine (
36
            qw( get_template_and_user check_cookie_auth checkauth check_api_auth check_value_builder_caller C4::Service->init )
37
            )
38
        {
36
            next FILE if $line =~ m|^[^#]*$routine|;
39
            next FILE if $line =~ m|^[^#]*$routine|;
37
        }
40
        }
38
    }
41
    }
39
- 

Return to bug 37041