Bugzilla – Attachment 126116 Details for
Bug 28948
Add a /public counterpart for the libraries REST endpoints
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 28948: Remove FIXME
Bug-28948-Remove-FIXME.patch (text/plain), 1.85 KB, created by
Martin Renvoize (ashimema)
on 2021-10-12 16:10:43 UTC
(
hide
)
Description:
Bug 28948: Remove FIXME
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2021-10-12 16:10:43 UTC
Size:
1.85 KB
patch
obsolete
>From 4340b78806c11e8341a0f0972d9c892b96115538 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Thu, 7 Oct 2021 14:51:51 -0300 >Subject: [PATCH] Bug 28948: Remove FIXME > >This patch reproduces what we did for `to_api_mapping`: make it always >present on Koha::Object classes. This has the side-effect of... making >things more secure! > >Before this patch, if undefined, all attributes were returned. > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > Koha/Object.pm | 25 ++++++++++++++++++++----- > 1 file changed, 20 insertions(+), 5 deletions(-) > >diff --git a/Koha/Object.pm b/Koha/Object.pm >index 6ebf7870be..12f138be71 100644 >--- a/Koha/Object.pm >+++ b/Koha/Object.pm >@@ -554,12 +554,9 @@ sub to_api { > my $json_object = $self->TO_JSON; > > # Remove forbidden attributes if required >- # FIXME: We should eventually require public_read_list in all objects and drop the conditional here. >- if ( $params->{public} >- and $self->can('public_read_list') ) >- { >+ if ( $params->{public} ) { > for my $field ( keys %{$json_object} ) { >- delete $json_object->{$field} unless any { $_ eq $field } @{$self->public_read_list}; >+ delete $json_object->{$field} unless any { $_ eq $field } @{ $self->public_read_list }; > } > } > >@@ -649,6 +646,24 @@ sub to_api_mapping { > return {}; > } > >+=head3 public_read_list >+ >+ >+ my @public_read_list = @{$object->public_read_list}; >+ >+Generic method that returns the list of database columns that are allowed to >+be passed to render objects on the public API. >+ >+Note: this only returns an empty I<arrayref>. Each class should have its >+own implementation. >+ >+=cut >+ >+sub public_read_list >+ { >+ return []; >+} >+ > =head3 from_api_mapping > > my $mapping = $object->from_api_mapping; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 28948
:
124479
|
124480
|
124481
|
124482
|
124483
|
124749
|
124911
|
124914
|
125901
|
125902
|
125903
|
125904
|
125905
|
125906
|
125907
|
125908
|
125911
|
125912
|
126111
|
126112
|
126113
|
126114
|
126115
|
126116
|
126117
|
126118
|
126119
|
126120
|
126121
|
126122
|
126123
|
126124
|
126125
|
126126
|
127054
|
127055