Bugzilla – Attachment 127994 Details for
Bug 29523
Add a way to prevent embedding objects that should not be allowed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29523: Make Koha::Object->to_api respect accessibility
Bug-29523-Make-KohaObject-toapi-respect-accessibil.patch (text/plain), 2.46 KB, created by
David Nind
on 2021-11-25 06:50:27 UTC
(
hide
)
Description:
Bug 29523: Make Koha::Object->to_api respect accessibility
Filename:
MIME Type:
Creator:
David Nind
Created:
2021-11-25 06:50:27 UTC
Size:
2.46 KB
patch
obsolete
>From 4e150d8ee475be3035896e8edf34c45e81642b5f Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 19 Nov 2021 13:13:59 -0300 >Subject: [PATCH] Bug 29523: Make Koha::Object->to_api respect accessibility > >This patch makes the *to_api* method honour the accessibility check for >the object. This is relevant in the context of embedding single objects. > >The Koha::Patron->to_api method is adjusted to reflect this behavior as >well (it does some manipulation after the ->to_api call and we need to >prevent it). > >To test: >1. Apply up to the regression tests >2. Run: > $ kshell > k$ prove t/db_dependent/Koha/Object.t >=> FAIL: A patron, that shouldn't be accessed, is returned by ->to_api >3. Apply this patch >4. Repeat 2 >=> SUCCESS: Tests pass! >6. Pick Henry Acevedo from the sample data, assign him 'catalogue' > permissions and a know user/password combination >7. Enable basic authentication >8. Point your favourite tool (Postman?) to > GET http://kohadev-intra.myDNSname.org:8081/api/v1/biblio/245/checkouts > Set the following header: x-koha-embed: patron > Pick whatever biblio you want, actually. >=> SUCCESS: No checkouts >9. Perform a couple checkouts on the chosen biblio. Make sure one > checkout is for a patron on the same library as Henry, and the other > on a different one. >10. Repeat 8 >=> SUCCESS: You see two checkouts. One of them has an attribute 'patron' > containing the patron from Henry's library. The other, has the > attribute set to 'null'. >11. Sign off :-D > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> > >Signed-off-by: David Nind <david@davidnind.com> >--- > Koha/Object.pm | 3 +++ > Koha/Patron.pm | 2 ++ > 2 files changed, 5 insertions(+) > >diff --git a/Koha/Object.pm b/Koha/Object.pm >index 08775ee45f..fe281dd58d 100644 >--- a/Koha/Object.pm >+++ b/Koha/Object.pm >@@ -551,6 +551,9 @@ Returns a representation of the object, suitable for API output. > > sub to_api { > my ( $self, $params ) = @_; >+ >+ return unless $self->accessible; >+ > my $json_object = $self->TO_JSON; > > # Remove forbidden attributes if required >diff --git a/Koha/Patron.pm b/Koha/Patron.pm >index 85d9c01bf1..adf916b5ea 100644 >--- a/Koha/Patron.pm >+++ b/Koha/Patron.pm >@@ -1766,6 +1766,8 @@ sub to_api { > > my $json_patron = $self->SUPER::to_api( $params ); > >+ return unless $json_patron; >+ > $json_patron->{restricted} = ( $self->is_debarred ) > ? Mojo::JSON->true > : Mojo::JSON->false; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29523
:
127886
|
127887
|
127888
|
127889
|
127991
|
127992
|
127993
|
127994
|
128042
|
128043
|
128044
|
128045
|
128046
|
128047
|
128048
|
128688
|
128689
|
128690
|
128691
|
128692
|
128693
|
128694
|
131326
|
131331
|
131332
|
136684
|
136685
|
136686
|
136687
|
136688
|
136689
|
136690
|
136691
|
136692
|
136706
|
136714
|
148736
|
148737
|
148738
|
148739
|
148740
|
148741
|
148742
|
148743
|
148744
|
148745
|
150989
|
150990
|
150991
|
150992
|
150993
|
150994
|
150995
|
150996
|
150997
|
150998
|
156939
|
156940
|
156941
|
156942
|
156943
|
156944
|
156945
|
156946
|
156947
|
156948
|
156949
|
156965
|
157049
|
157071
|
157072
|
157073
|
157074
|
157075
|
157076
|
157077
|
157078
|
157079
|
157080
|
157081
|
157406
|
157407
|
157408
|
157409
|
157410
|
157411
|
157412
|
157413
|
157414
|
157415
|
157416
|
157673
|
157679
|
157683
|
157799
|
157881
|
157882
|
157883
|
157884
|
157885
|
157886
|
157887
|
157888
|
157889
|
157890
|
157891
|
157892
|
157893
|
158013