Bugzilla – Attachment 148737 Details for
Bug 29523
Add a way to prevent embedding objects that should not be allowed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29523: Add Koha::Object->accessible
Bug-29523-Add-KohaObject-accessible.patch (text/plain), 3.56 KB, created by
Martin Renvoize (ashimema)
on 2023-03-27 08:59:56 UTC
(
hide
)
Description:
Bug 29523: Add Koha::Object->accessible
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2023-03-27 08:59:56 UTC
Size:
3.56 KB
patch
obsolete
>From 93fde35560c54015a96c3beca570ed3c84261748 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 19 Nov 2021 09:55:15 -0300 >Subject: [PATCH] Bug 29523: Add Koha::Object->accessible > >This patch introduces a method for checking if an object can be >retrieved by the current user. It depends on the plural class >implementation of the ->search_limited method. > >To test: >1. Apply this patch >2. Run: > $ kshell > k$ prove t/db_dependent/Koha/Object.t >=> SUCCESS: Tests pass! >3. Sign off :-D > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >Signed-off-by: David Nind <david@davidnind.com> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/Object.pm | 35 +++++++++++++++++++++++++++++++++++ > t/db_dependent/Koha/Object.t | 36 +++++++++++++++++++++++++++++++++++- > 2 files changed, 70 insertions(+), 1 deletion(-) > >diff --git a/Koha/Object.pm b/Koha/Object.pm >index e463f94920..60e72f003e 100644 >--- a/Koha/Object.pm >+++ b/Koha/Object.pm >@@ -893,6 +893,19 @@ sub _get_object_class { > return ${type}; > } > >+sub _get_objects_class { >+ my ( $self ) = @_; >+ return unless $self; >+ >+ if ( $self->_result->can('koha_objects_class') ) { >+ return $self->_result->koha_objects_class; >+ } >+ my $type = ref($self); >+ >+ $type =~ s|Schema::Result::||; >+ return $type . "s"; >+} >+ > =head3 AUTOLOAD > > The autoload method is used only to get and set values for an objects properties. >@@ -972,6 +985,28 @@ sub _handle_to_api_child { > return $res; > } > >+=head3 accessible >+ >+ if ( $object->accessible ) { ... } >+ >+Whether the object should be accessible in the current context (requesting user). >+It relies on the plural class properly implementing the I<search_limited> method. >+ >+=cut >+ >+sub accessible { >+ my ($self) = @_; >+ >+ return $self->_get_objects_class->search_limited( >+ { >+ map { $_ => $self->$_ } >+ $self->_result->result_source->primary_columns >+ } >+ )->count > 0 >+ ? 1 >+ : 0; >+} >+ > sub DESTROY { } > > =head1 AUTHOR >diff --git a/t/db_dependent/Koha/Object.t b/t/db_dependent/Koha/Object.t >index a49a3784c2..d0f653bda7 100755 >--- a/t/db_dependent/Koha/Object.t >+++ b/t/db_dependent/Koha/Object.t >@@ -17,7 +17,7 @@ > > use Modern::Perl; > >-use Test::More tests => 21; >+use Test::More tests => 22; > use Test::Exception; > use Test::Warn; > use DateTime; >@@ -1112,3 +1112,37 @@ subtest 'messages() and add_message() tests' => sub { > > $schema->storage->txn_rollback; > }; >+ >+subtest 'accessible() tests' => sub { >+ >+ plan tests => 2; >+ >+ $schema->storage->txn_begin; >+ >+ my $library_1 = $builder->build_object( { class => 'Koha::Libraries' } ); >+ my $library_2 = $builder->build_object( { class => 'Koha::Libraries' } ); >+ >+ my $patron = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { >+ flags => 2**2, # only has catalogue permissions >+ branchcode => $library_1->id >+ } >+ } >+ ); >+ >+ my $patron_1 = $builder->build_object( >+ { class => 'Koha::Patrons', value => { branchcode => $library_1->id } } >+ ); >+ my $patron_2 = $builder->build_object( >+ { class => 'Koha::Patrons', value => { branchcode => $library_2->id } } >+ ); >+ >+ t::lib::Mocks::mock_userenv( { patron => $patron } ); >+ >+ ok( $patron_1->accessible, 'Has access to the patron' ); >+ ok( !$patron_2->accessible, 'Does not have access to the patron' ); >+ >+ $schema->storage->txn_rollback; >+}; >-- >2.40.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29523
:
127886
|
127887
|
127888
|
127889
|
127991
|
127992
|
127993
|
127994
|
128042
|
128043
|
128044
|
128045
|
128046
|
128047
|
128048
|
128688
|
128689
|
128690
|
128691
|
128692
|
128693
|
128694
|
131326
|
131331
|
131332
|
136684
|
136685
|
136686
|
136687
|
136688
|
136689
|
136690
|
136691
|
136692
|
136706
|
136714
|
148736
|
148737
|
148738
|
148739
|
148740
|
148741
|
148742
|
148743
|
148744
|
148745
|
150989
|
150990
|
150991
|
150992
|
150993
|
150994
|
150995
|
150996
|
150997
|
150998
|
156939
|
156940
|
156941
|
156942
|
156943
|
156944
|
156945
|
156946
|
156947
|
156948
|
156949
|
156965
|
157049
|
157071
|
157072
|
157073
|
157074
|
157075
|
157076
|
157077
|
157078
|
157079
|
157080
|
157081
|
157406
|
157407
|
157408
|
157409
|
157410
|
157411
|
157412
|
157413
|
157414
|
157415
|
157416
|
157673
|
157679
|
157683
|
157799
|
157881
|
157882
|
157883
|
157884
|
157885
|
157886
|
157887
|
157888
|
157889
|
157890
|
157891
|
157892
|
157893
|
158013