Bugzilla – Attachment 150997 Details for
Bug 29523
Add a way to prevent embedding objects that should not be allowed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29523: Remove the FIXME
Bug-29523-Remove-the-FIXME.patch (text/plain), 8.95 KB, created by
Martin Renvoize (ashimema)
on 2023-05-10 12:57:14 UTC
(
hide
)
Description:
Bug 29523: Remove the FIXME
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2023-05-10 12:57:14 UTC
Size:
8.95 KB
patch
obsolete
>From 7136f398c1fa4910bc58290736ce936a51ff8218 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 28 Jun 2022 16:50:29 +0100 >Subject: [PATCH] Bug 29523: Remove the FIXME > >This patch works through the unit tests and existing code to allow >removal of the FIXME I introduced earlier in the patchset. > >We now require the `user` parameter be passed to `is_accessible` which >in turn makes `user` a required parameter for `to_api` in the >`Koha::Patron` case. >--- > Koha/Patron.pm | 10 +++--- > Koha/REST/V1/Patrons.pm | 9 +++-- > t/db_dependent/api/v1/acquisitions_baskets.t | 12 +++++-- > t/db_dependent/api/v1/acquisitions_funds.t | 26 ++++++++++++--- > t/db_dependent/api/v1/patrons.t | 35 ++++++++++++-------- > 5 files changed, 64 insertions(+), 28 deletions(-) > >diff --git a/Koha/Patron.pm b/Koha/Patron.pm >index 05ce1145a4..36bf786dae 100644 >--- a/Koha/Patron.pm >+++ b/Koha/Patron.pm >@@ -38,6 +38,7 @@ use Koha::Club::Enrollments; > use Koha::Database; > use Koha::DateUtils qw( dt_from_string ); > use Koha::Encryption; >+use Koha::Exceptions; > use Koha::Exceptions::Password; > use Koha::Holds; > use Koha::CurbsidePickups; >@@ -2080,11 +2081,10 @@ Returns 0 if the I<user> parameter is missing. > sub is_accessible { > my ( $self, $params ) = @_; > >- # FIXME? It felt tempting to return 0 instead >- # but it would mean needing to explicitly add the 'user' >- # param in all tests... >- return 1 >- unless $params->{user}; >+ unless ( defined( $params->{user} ) ) { >+ Koha::Exceptions::MissingParameter->throw( >+ error => "The `user` parameter is mandatory" ); >+ } > > my $consumer = $params->{user}; > return $consumer->can_see_patron_infos($self); >diff --git a/Koha/REST/V1/Patrons.pm b/Koha/REST/V1/Patrons.pm >index 1852d7ccd2..109cdca9b0 100644 >--- a/Koha/REST/V1/Patrons.pm >+++ b/Koha/REST/V1/Patrons.pm >@@ -102,6 +102,7 @@ Controller function that handles adding a new Koha::Patron object > > sub add { > my $c = shift->openapi->valid_input or return; >+ my $current_user = $c->stash( 'koha.user' ); > > return try { > >@@ -131,7 +132,7 @@ sub add { > $c->res->headers->location($c->req->url->to_string . '/' . $patron->borrowernumber); > return $c->render( > status => 201, >- openapi => $patron->to_api >+ openapi => $patron->to_api({ user => $current_user }) > ); > } > ); >@@ -224,6 +225,7 @@ Controller function that handles updating a Koha::Patron object > > sub update { > my $c = shift->openapi->valid_input or return; >+ my $current_user = $c->stash( 'koha.user' ); > > my $patron_id = $c->validation->param('patron_id'); > my $patron = Koha::Patrons->find( $patron_id ); >@@ -271,7 +273,10 @@ sub update { > > $patron->set_from_api($c->validation->param('body'))->store; > $patron->discard_changes; >- return $c->render( status => 200, openapi => $patron->to_api ); >+ return $c->render( >+ status => 200, >+ openapi => $patron->to_api( { user => $current_user } ) >+ ); > } > catch { > unless ( blessed $_ && $_->can('rethrow') ) { >diff --git a/t/db_dependent/api/v1/acquisitions_baskets.t b/t/db_dependent/api/v1/acquisitions_baskets.t >index 92261f5d88..dd1edbb342 100755 >--- a/t/db_dependent/api/v1/acquisitions_baskets.t >+++ b/t/db_dependent/api/v1/acquisitions_baskets.t >@@ -57,8 +57,16 @@ subtest 'list_managers() tests' => sub { > } > ); > >- $t->get_ok("//$userid:$password@/api/v1/acquisitions/baskets/managers?q=$api_filter") >- ->status_is(200)->json_is( [ $patron_with_permission->to_api, $superlibrarian->to_api ] ); >+ $t->get_ok( >+ "//$userid:$password@/api/v1/acquisitions/baskets/managers?q=$api_filter" >+ )->status_is(200)->json_is( >+ [ >+ $patron_with_permission->to_api( >+ { user => $patron_with_permission } >+ ), >+ $superlibrarian->to_api( { user => $superlibrarian } ) >+ ] >+ ); > > $schema->storage->txn_rollback; > }; >diff --git a/t/db_dependent/api/v1/acquisitions_funds.t b/t/db_dependent/api/v1/acquisitions_funds.t >index d4821586f1..56283fe9f8 100755 >--- a/t/db_dependent/api/v1/acquisitions_funds.t >+++ b/t/db_dependent/api/v1/acquisitions_funds.t >@@ -113,11 +113,27 @@ subtest 'list_owners() and list_users() tests' => sub { > } > ); > >- $t->get_ok("//$userid:$password@/api/v1/acquisitions/funds/owners?q=$api_filter") >- ->status_is(200)->json_is( [ $patron_with_permission->to_api, $superlibrarian->to_api ] ); >- >- $t->get_ok("//$userid:$password@/api/v1/acquisitions/funds/users?q=$api_filter") >- ->status_is(200)->json_is( [ $patron_with_permission->to_api, $superlibrarian->to_api ] ); >+ $t->get_ok( >+ "//$userid:$password@/api/v1/acquisitions/funds/owners?q=$api_filter") >+ ->status_is(200)->json_is( >+ [ >+ $patron_with_permission->to_api( >+ { user => $patron_with_permission } >+ ), >+ $superlibrarian->to_api( { user => $superlibrarian } ) >+ ] >+ ); >+ >+ $t->get_ok( >+ "//$userid:$password@/api/v1/acquisitions/funds/users?q=$api_filter") >+ ->status_is(200)->json_is( >+ [ >+ $patron_with_permission->to_api( >+ { user => $patron_with_permission } >+ ), >+ $superlibrarian->to_api( { user => $superlibrarian } ) >+ ] >+ ); > > $schema->storage->txn_rollback; > }; >diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t >index 8c4d9c13e1..b9dc45c78d 100755 >--- a/t/db_dependent/api/v1/patrons.t >+++ b/t/db_dependent/api/v1/patrons.t >@@ -295,7 +295,13 @@ subtest 'add() tests' => sub { > > $schema->storage->txn_begin; > >- my $patron = $builder->build_object( { class => 'Koha::Patrons' } )->to_api; >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**4 } # borrowers flag = 4 >+ } >+ ); >+ my $patron = $builder->build_object( { class => 'Koha::Patrons' } )->to_api({ user => $librarian }); > > unauthorized_access_tests('POST', undef, $patron); > >@@ -339,8 +345,15 @@ subtest 'add() tests' => sub { > } > ); > >- my $patron = $builder->build_object({ class => 'Koha::Patrons' }); >- my $newpatron = $patron->to_api; >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**4 } # borrowers flag = 4 >+ } >+ ); >+ >+ my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); >+ my $newpatron = $patron->to_api({ user => $librarian }); > # delete RO attributes > delete $newpatron->{patron_id}; > delete $newpatron->{restricted}; >@@ -352,12 +365,6 @@ subtest 'add() tests' => sub { > # Delete library > $library_to_delete->delete; > >- my $librarian = $builder->build_object( >- { >- class => 'Koha::Patrons', >- value => { flags => 2**4 } # borrowers flag = 4 >- } >- ); > my $password = 'thePassword123'; > $librarian->set_password( { password => $password, skip_validation => 1 } ); > my $userid = $librarian->userid; >@@ -391,7 +398,7 @@ subtest 'add() tests' => sub { > delete $newpatron->{falseproperty}; > > my $patron_to_delete = $builder->build_object({ class => 'Koha::Patrons' }); >- $newpatron = $patron_to_delete->to_api; >+ $newpatron = $patron_to_delete->to_api({ user => $librarian }); > # delete RO attributes > delete $newpatron->{patron_id}; > delete $newpatron->{restricted}; >@@ -617,7 +624,7 @@ subtest 'update() tests' => sub { > > my $patron_1 = $authorized_patron; > my $patron_2 = $unauthorized_patron; >- my $newpatron = $unauthorized_patron->to_api; >+ my $newpatron = $unauthorized_patron->to_api({ user => $authorized_patron }); > # delete RO attributes > delete $newpatron->{patron_id}; > delete $newpatron->{restricted}; >@@ -694,9 +701,9 @@ subtest 'update() tests' => sub { > ->status_is(200, 'Patron updated successfully'); > > # Put back the RO attributes >- $newpatron->{patron_id} = $unauthorized_patron->to_api->{patron_id}; >- $newpatron->{restricted} = $unauthorized_patron->to_api->{restricted}; >- $newpatron->{anonymized} = $unauthorized_patron->to_api->{anonymized}; >+ $newpatron->{patron_id} = $unauthorized_patron->to_api({ user => $authorized_patron })->{patron_id}; >+ $newpatron->{restricted} = $unauthorized_patron->to_api({ user => $authorized_patron })->{restricted}; >+ $newpatron->{anonymized} = $unauthorized_patron->to_api({ user => $authorized_patron })->{anonymized}; > > my $got = $result->tx->res->json; > my $updated_on_got = delete $got->{updated_on}; >-- >2.40.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29523
:
127886
|
127887
|
127888
|
127889
|
127991
|
127992
|
127993
|
127994
|
128042
|
128043
|
128044
|
128045
|
128046
|
128047
|
128048
|
128688
|
128689
|
128690
|
128691
|
128692
|
128693
|
128694
|
131326
|
131331
|
131332
|
136684
|
136685
|
136686
|
136687
|
136688
|
136689
|
136690
|
136691
|
136692
|
136706
|
136714
|
148736
|
148737
|
148738
|
148739
|
148740
|
148741
|
148742
|
148743
|
148744
|
148745
|
150989
|
150990
|
150991
|
150992
|
150993
|
150994
|
150995
|
150996
|
150997
|
150998
|
156939
|
156940
|
156941
|
156942
|
156943
|
156944
|
156945
|
156946
|
156947
|
156948
|
156949
|
156965
|
157049
|
157071
|
157072
|
157073
|
157074
|
157075
|
157076
|
157077
|
157078
|
157079
|
157080
|
157081
|
157406
|
157407
|
157408
|
157409
|
157410
|
157411
|
157412
|
157413
|
157414
|
157415
|
157416
|
157673
|
157679
|
157683
|
157799
|
157881
|
157882
|
157883
|
157884
|
157885
|
157886
|
157887
|
157888
|
157889
|
157890
|
157891
|
157892
|
157893
|
158013