Bugzilla – Attachment 136690 Details for
Bug 29523
Add a way to prevent embedding objects that should not be allowed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29523: Pass the logged user around and use for validating
Bug-29523-Pass-the-logged-user-around-and-use-for-.patch (text/plain), 5.78 KB, created by
Martin Renvoize (ashimema)
on 2022-06-28 16:04:20 UTC
(
hide
)
Description:
Bug 29523: Pass the logged user around and use for validating
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-06-28 16:04:20 UTC
Size:
5.78 KB
patch
obsolete
>From a8809988cedd5e841b51ad1ca17e7dfe76803801 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Fri, 26 Nov 2021 15:35:05 +0000 >Subject: [PATCH] Bug 29523: Pass the logged user around and use for validating > >In this patch I add 'user', containing the Koha::Patron object for the >logged in user in the params hash we pass around in to_api. I then use >that in a new 'is_accessible' method added to Koha::Patron. > >The new method is really the equivilent of 'search_limited' in the plural >class and could perhaps be renamed 'is_limited' or something clearer for >the singular form 'is_filtered' or 'fitler_for_api' or something? > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/Object.pm | 20 ++++++-------------- > Koha/Patron.pm | 24 ++++++++++++++++++++++++ > Koha/REST/Plugin/Objects.pm | 4 ++-- > t/db_dependent/Koha/Object.t | 15 ++++++++------- > 4 files changed, 40 insertions(+), 23 deletions(-) > >diff --git a/Koha/Object.pm b/Koha/Object.pm >index c5cf7e917c..515d8375c0 100644 >--- a/Koha/Object.pm >+++ b/Koha/Object.pm >@@ -552,7 +552,7 @@ Returns a representation of the object, suitable for API output. > sub to_api { > my ( $self, $params ) = @_; > >- return unless $self->accessible; >+ return unless $self->is_accessible($params); > > my $json_object = $self->TO_JSON; > >@@ -938,26 +938,18 @@ sub _handle_to_api_child { > return $res; > } > >-=head3 accessible >+=head3 is_accessible > >- if ( $object->accessible ) { ... } >+ if ( $object->is_accessible ) { ... } > >-Whether the object should be accessible in the current context (requesting user). >-It relies on the plural class properly implementing the I<search_limited> method. >+Stub method that is expected to be overloaded (if required) by implementing classes. > > =cut > >-sub accessible { >+sub is_accessible { > my ($self) = @_; > >- return $self->_get_objects_class->search_limited( >- { >- map { $_ => $self->$_ } >- $self->_result->result_source->primary_columns >- } >- )->count > 0 >- ? 1 >- : 0; >+ return 1; > } > > sub DESTROY { } >diff --git a/Koha/Patron.pm b/Koha/Patron.pm >index 68b4e70d4e..b9767d56ca 100644 >--- a/Koha/Patron.pm >+++ b/Koha/Patron.pm >@@ -1868,6 +1868,30 @@ sub get_extended_attribute { > return $attribute->next; > } > >+=head3 is_accessible >+ >+ if ( $patron->is_accessible({ user => $logged_in_user }) ) { ... } >+ >+This overloaded method validates wether the current I<Koha::Patron> object can be accessed >+by the logged in user. >+ >+Returns 0 if the I<user> parameter is missing. >+ >+=cut >+ >+sub is_accessible { >+ my ( $self, $params ) = @_; >+ >+ # FIXME? It felt tempting to return 0 instead >+ # but it would mean needing to explicitly add the 'user' >+ # param in all tests... >+ return 1 >+ unless $params->{user}; >+ >+ my $consumer = $params->{user}; >+ return $consumer->can_see_patron_infos($self); >+} >+ > =head3 to_api > > my $json = $patron->to_api; >diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm >index 4a5d29143c..8b122d3ae3 100644 >--- a/Koha/REST/Plugin/Objects.pm >+++ b/Koha/REST/Plugin/Objects.pm >@@ -66,7 +66,7 @@ the requested object. It passes through any embeds if specified. > > return unless $object; > >- return $object->to_api({ embed => $embed }); >+ return $object->to_api({ embed => $embed, user => $c->stash('koha.user') }); > } > ); > >@@ -202,7 +202,7 @@ shouldn't be called twice in it. > } > ); > >- return $objects->to_api({ embed => $embed, public => $is_public }); >+ return $objects->to_api({ embed => $embed, public => $is_public, user => $c->stash('koha.user') }); > } > ); > } >diff --git a/t/db_dependent/Koha/Object.t b/t/db_dependent/Koha/Object.t >index 38e5fb6c80..eec79571ce 100755 >--- a/t/db_dependent/Koha/Object.t >+++ b/t/db_dependent/Koha/Object.t >@@ -361,14 +361,15 @@ subtest "to_api() tests" => sub { > > my $patron_api = $patron->to_api( > { >- embed => { holds_count => { is_count => 1 } } >+ embed => { holds_count => { is_count => 1 } }, >+ user => $patron > } > ); > is( $patron_api->{holds_count}, $patron->holds->count, 'Count embeds are supported and work as expected' ); > > throws_ok > { >- $patron->to_api({ embed => { holds_count => {} } }); >+ $patron->to_api({ embed => { holds_count => {} }, user => $patron }); > } > 'Koha::Exceptions::Object::MethodNotCoveredByTests', > 'Unknown method exception thrown if is_count not specified'; >@@ -448,8 +449,8 @@ subtest "to_api() tests" => sub { > > t::lib::Mocks::mock_userenv( { patron => $patron } ); > >- is( ref($patron_1->to_api), 'HASH', 'Returns the object hash' ); >- is( $patron_2->to_api, undef, 'Not accessible, returns undef' ); >+ is( ref($patron_1->to_api({ user => $patron })), 'HASH', 'Returns the object hash' ); >+ is( $patron_2->to_api({ user => $patron }), undef, 'Not accessible, returns undef' ); > > $schema->storage->txn_rollback; > }; >@@ -1031,7 +1032,7 @@ subtest 'messages() and add_message() tests' => sub { > $schema->storage->txn_rollback; > }; > >-subtest 'accessible() tests' => sub { >+subtest 'is_accessible() tests' => sub { > > plan tests => 2; > >@@ -1059,8 +1060,8 @@ subtest 'accessible() tests' => sub { > > t::lib::Mocks::mock_userenv( { patron => $patron } ); > >- ok( $patron_1->accessible, 'Has access to the patron' ); >- ok( !$patron_2->accessible, 'Does not have access to the patron' ); >+ ok( $patron_1->is_accessible({ user => $patron }), 'Has access to the patron' ); >+ ok( !$patron_2->is_accessible({ user => $patron }), 'Does not have access to the patron' ); > > $schema->storage->txn_rollback; > }; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29523
:
127886
|
127887
|
127888
|
127889
|
127991
|
127992
|
127993
|
127994
|
128042
|
128043
|
128044
|
128045
|
128046
|
128047
|
128048
|
128688
|
128689
|
128690
|
128691
|
128692
|
128693
|
128694
|
131326
|
131331
|
131332
|
136684
|
136685
|
136686
|
136687
|
136688
|
136689
|
136690
|
136691
|
136692
|
136706
|
136714
|
148736
|
148737
|
148738
|
148739
|
148740
|
148741
|
148742
|
148743
|
148744
|
148745
|
150989
|
150990
|
150991
|
150992
|
150993
|
150994
|
150995
|
150996
|
150997
|
150998
|
156939
|
156940
|
156941
|
156942
|
156943
|
156944
|
156945
|
156946
|
156947
|
156948
|
156949
|
156965
|
157049
|
157071
|
157072
|
157073
|
157074
|
157075
|
157076
|
157077
|
157078
|
157079
|
157080
|
157081
|
157406
|
157407
|
157408
|
157409
|
157410
|
157411
|
157412
|
157413
|
157414
|
157415
|
157416
|
157673
|
157679
|
157683
|
157799
|
157881
|
157882
|
157883
|
157884
|
157885
|
157886
|
157887
|
157888
|
157889
|
157890
|
157891
|
157892
|
157893
|
158013