|
Lines 91-104
sub authenticate_api_request {
Link Here
|
| 91 |
) if $cookie and $action_spec->{'x-koha-authorization'}; |
91 |
) if $cookie and $action_spec->{'x-koha-authorization'}; |
| 92 |
} |
92 |
} |
| 93 |
|
93 |
|
| 94 |
# Check for malformed query parameters |
94 |
my @errors = validate_parameters( $c, $action_spec ); |
| 95 |
my @errors; |
95 |
return $c->render_swagger({}, \@errors, 400) if @errors; |
| 96 |
my %valid_parameters = map { $_->{name} => 1 if $_->{in} eq 'query' } @{$action_spec->{parameters}}; |
|
|
| 97 |
my $existing_params = $c->req->query_params->to_hash; |
| 98 |
for my $param ( keys %{$existing_params} ) { |
| 99 |
push @errors, { path => "/query/".$param, message => 'Malformed query string' } unless exists $valid_parameters{$param}; |
| 100 |
} |
| 101 |
return $c->render_swagger({},\@errors,400) if @errors; |
| 102 |
|
96 |
|
| 103 |
return $next->($c) unless $action_spec->{'x-koha-authorization'}; |
97 |
return $next->($c) unless $action_spec->{'x-koha-authorization'}; |
| 104 |
unless ($user) { |
98 |
unless ($user) { |
|
Lines 107-115
sub authenticate_api_request {
Link Here
|
| 107 |
|
101 |
|
| 108 |
my $authorization = $action_spec->{'x-koha-authorization'}; |
102 |
my $authorization = $action_spec->{'x-koha-authorization'}; |
| 109 |
my $permissions = $authorization->{'permissions'}; |
103 |
my $permissions = $authorization->{'permissions'}; |
| 110 |
return $next->($c) if C4::Auth::haspermission($user->userid, $permissions); |
104 |
if ( C4::Auth::haspermission($user->userid, $permissions) |
| 111 |
return $next->($c) if allow_owner($c, $authorization, $user); |
105 |
or allow_owner($c, $authorization, $user) |
| 112 |
return $next->($c) if allow_guarantor($c, $authorization, $user); |
106 |
or allow_guarantor($c, $authorization, $user) ) { |
|
|
107 |
return $next->($c) |
| 108 |
} |
| 113 |
return $c->render_swagger( |
109 |
return $c->render_swagger( |
| 114 |
{ error => "Authorization failure. Missing required permission(s).", |
110 |
{ error => "Authorization failure. Missing required permission(s).", |
| 115 |
required_permissions => $permissions }, |
111 |
required_permissions => $permissions }, |
|
Lines 118-123
sub authenticate_api_request {
Link Here
|
| 118 |
); |
114 |
); |
| 119 |
} |
115 |
} |
| 120 |
|
116 |
|
|
|
117 |
sub validate_parameters { |
| 118 |
my ( $c, $action_spec ) = @_; |
| 119 |
|
| 120 |
# Check for malformed query parameters |
| 121 |
my @errors; |
| 122 |
my %valid_parameters = map { ( $_->{in} eq 'query' ) ? ( $_->{name} => 1 ) : () } @{ $action_spec->{parameters} }; |
| 123 |
my $existing_params = $c->req->query_params->to_hash; |
| 124 |
for my $param ( keys %{$existing_params} ) { |
| 125 |
push @errors, { path => "/query/" . $param, message => 'Malformed query string' } unless exists $valid_parameters{$param}; |
| 126 |
} |
| 127 |
return @errors; |
| 128 |
} |
| 129 |
|
| 130 |
|
| 121 |
=head3 allow_owner |
131 |
=head3 allow_owner |
| 122 |
|
132 |
|
| 123 |
Allows access to object for its owner. |
133 |
Allows access to object for its owner. |
| 124 |
- |
|
|