Bugzilla – Attachment 128048 Details for
Bug 29523
Add a way to prevent embedding objects that should not be allowed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
ALT: An idea of doing it at singular level?
ALT-An-idea-of-doing-it-at-singular-level.patch (text/plain), 3.84 KB, created by
Martin Renvoize (ashimema)
on 2021-11-26 15:41:46 UTC
(
hide
)
Description:
ALT: An idea of doing it at singular level?
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2021-11-26 15:41:46 UTC
Size:
3.84 KB
patch
obsolete
>From f728fce33b9ec03eee53bf9f1567324650610648 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Fri, 26 Nov 2021 15:35:05 +0000 >Subject: [PATCH] ALT: An idea of doing it at singular level? > >In this patch I add 'user', containing the Koha::Patron object for the >logged in user in the params hash we pass around in to_api. I then use >that in a new 'is_accessible_in_context' method added to Koha::Patron. > >The method name is a bit of a mouthfull.. it could be 'is_limited' as >it's really the equivilent of 'search_limited' in the plural class.. but >I wasn't sure that was actually clearer... if we like it we could strip >back out some of the work around search_related. > >As an asside, I also update Koha::Patron->can_see_patrons_from to use >Koha::Patron->libraries_where_can_see_patrons internally.. DRY! > >https://bugs.koha-community.org/show_bug.cgi?id=29523 >--- > Koha/Object.pm | 6 ++++-- > Koha/Patron.pm | 28 ++++++++++++++-------------- > Koha/REST/Plugin/Objects.pm | 4 ++-- > 3 files changed, 20 insertions(+), 18 deletions(-) > >diff --git a/Koha/Object.pm b/Koha/Object.pm >index fe281dd58d..8fd8371888 100644 >--- a/Koha/Object.pm >+++ b/Koha/Object.pm >@@ -552,7 +552,7 @@ Returns a representation of the object, suitable for API output. > sub to_api { > my ( $self, $params ) = @_; > >- return unless $self->accessible; >+ return unless $self->is_accessible_in_context($params); > > my $json_object = $self->TO_JSON; > >@@ -947,9 +947,11 @@ It relies on the plural class properly implementing the I<search_limited> method > > =cut > >-sub accessible { >+sub is_accessible_in_context { > my ($self) = @_; > >+ return 1 and warn "is_accessible_in_context default called"; >+ > return $self->_get_objects_class->search_limited( > { > map { $_ => $self->$_ } >diff --git a/Koha/Patron.pm b/Koha/Patron.pm >index adf916b5ea..de55beb7f9 100644 >--- a/Koha/Patron.pm >+++ b/Koha/Patron.pm >@@ -1348,20 +1348,9 @@ Return true if the patron (usually the logged in user) can see the patron's info > > sub can_see_patrons_from { > my ( $self, $branchcode ) = @_; >- my $can = 0; >- if ( $self->branchcode eq $branchcode ) { >- $can = 1; >- } elsif ( $self->has_permission( { borrowers => 'view_borrower_infos_from_any_libraries' } ) ) { >- $can = 1; >- } elsif ( my $library_groups = $self->library->library_groups ) { >- while ( my $library_group = $library_groups->next ) { >- if ( $library_group->parent->has_child( $branchcode ) ) { >- $can = 1; >- last; >- } >- } >- } >- return $can; >+ my @branches = $self->libraries_where_can_see_patrons; >+ return 1 unless @branches; >+ return any { $_ eq $branchcode } @branches; > } > > =head3 can_log_into >@@ -1752,6 +1741,17 @@ sub get_extended_attribute { > return $attribute->next; > } > >+=head3 is_accessible_in_context >+ >+=cut >+ >+sub is_accessible_in_context { >+ my ($self, $params) = @_; >+ >+ my $consumer = $params->{user}; >+ return $consumer->can_see_patron_infos($self); >+} >+ > =head3 to_api > > my $json = $patron->to_api; >diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm >index ddf2194530..ef58e09189 100644 >--- a/Koha/REST/Plugin/Objects.pm >+++ b/Koha/REST/Plugin/Objects.pm >@@ -66,7 +66,7 @@ the requested object. It passes through any embeds if specified. > > return unless $object; > >- return $object->to_api({ embed => $embed }); >+ return $object->to_api({ embed => $embed, user => $c->stash('koha.user') }); > } > ); > >@@ -164,7 +164,7 @@ for API rendering. > } > ); > >- return $objects->to_api({ embed => $embed, public => $is_public }); >+ return $objects->to_api({ embed => $embed, public => $is_public, user => $c->stash('koha.user') }); > } > ); > } >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29523
:
127886
|
127887
|
127888
|
127889
|
127991
|
127992
|
127993
|
127994
|
128042
|
128043
|
128044
|
128045
|
128046
|
128047
|
128048
|
128688
|
128689
|
128690
|
128691
|
128692
|
128693
|
128694
|
131326
|
131331
|
131332
|
136684
|
136685
|
136686
|
136687
|
136688
|
136689
|
136690
|
136691
|
136692
|
136706
|
136714
|
148736
|
148737
|
148738
|
148739
|
148740
|
148741
|
148742
|
148743
|
148744
|
148745
|
150989
|
150990
|
150991
|
150992
|
150993
|
150994
|
150995
|
150996
|
150997
|
150998
|
156939
|
156940
|
156941
|
156942
|
156943
|
156944
|
156945
|
156946
|
156947
|
156948
|
156949
|
156965
|
157049
|
157071
|
157072
|
157073
|
157074
|
157075
|
157076
|
157077
|
157078
|
157079
|
157080
|
157081
|
157406
|
157407
|
157408
|
157409
|
157410
|
157411
|
157412
|
157413
|
157414
|
157415
|
157416
|
157673
|
157679
|
157683
|
157799
|
157881
|
157882
|
157883
|
157884
|
157885
|
157886
|
157887
|
157888
|
157889
|
157890
|
157891
|
157892
|
157893
|
158013