Bugzilla – Attachment 172349 Details for
Bug 33260
Show message queue on staff interface and make notices printable
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 33260: Use search_limited to protect message privacy, and unit test
Bug-33260-Use-searchlimited-to-protect-message-pri.patch (text/plain), 4.56 KB, created by
Martin Renvoize (ashimema)
on 2024-10-03 14:35:28 UTC
(
hide
)
Description:
Bug 33260: Use search_limited to protect message privacy, and unit test
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2024-10-03 14:35:28 UTC
Size:
4.56 KB
patch
obsolete
>From f851ff454d040eb23aa6fdfa5439dba933670a4b Mon Sep 17 00:00:00 2001 >From: Aleisha Amohia <aleishaamohia@hotmail.com> >Date: Mon, 6 May 2024 03:00:20 +0000 >Subject: [PATCH] Bug 33260: Use search_limited to protect message privacy, and > unit test > >This patch adds a Koha::Notice::Messages->search_limited sub to allow better control over which patron's notices the user can see. > >Test added to t/db_dependent/Koha/Notice/Message.t > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > Koha/Notice/Messages.pm | 25 ++++++++++++++++++- > t/db_dependent/Koha/Notice/Message.t | 36 +++++++++++++++++++++++++++- > tools/notices.pl | 4 ++-- > 3 files changed, 61 insertions(+), 4 deletions(-) > >diff --git a/Koha/Notice/Messages.pm b/Koha/Notice/Messages.pm >index 3fedd5d1424..07d612f4e10 100644 >--- a/Koha/Notice/Messages.pm >+++ b/Koha/Notice/Messages.pm >@@ -17,7 +17,6 @@ package Koha::Notice::Messages; > > use Modern::Perl; > >- > use Koha::Database; > > use Koha::Notice::Message; >@@ -34,6 +33,30 @@ Koha::Notice::Message - Koha notice message Object class, related to the message > > =cut > >+=head3 search_limited >+ >+ my $messages = Koha::Notice::Messages->search_limited( $params, $attributes ); >+ >+Search for generated and queued notices according to logged in patron restrictions >+ >+=cut >+ >+sub search_limited { >+ my ( $self, $params, $attributes ) = @_; >+ >+ my $userenv = C4::Context->userenv; >+ my @restricted_branchcodes; >+ if ( $userenv and $userenv->{number} ) { >+ my $logged_in_user = Koha::Patrons->find( $userenv->{number} ); >+ @restricted_branchcodes = $logged_in_user->libraries_where_can_see_patrons; >+ } >+ >+ # TODO This 'borrowernumber' relation name is confusing and needs to be renamed >+ $params->{'borrowernumber.branchcode'} = { -in => \@restricted_branchcodes } if @restricted_branchcodes; >+ $attributes->{join} = 'borrowernumber'; >+ return $self->search( $params, $attributes ); >+} >+ > =head3 type > > =cut >diff --git a/t/db_dependent/Koha/Notice/Message.t b/t/db_dependent/Koha/Notice/Message.t >index 4286a371f2f..0c6a1f84781 100755 >--- a/t/db_dependent/Koha/Notice/Message.t >+++ b/t/db_dependent/Koha/Notice/Message.t >@@ -19,7 +19,7 @@ > > use Modern::Perl; > >-use Test::More tests => 2; >+use Test::More tests => 3; > > use C4::Letters qw( GetPreparedLetter EnqueueLetter ); > >@@ -239,4 +239,38 @@ subtest 'patron() tests' => sub { > $schema->storage->txn_rollback; > }; > >+subtest 'search_limited' => sub { >+ plan tests => 2; >+ >+ $schema->storage->txn_begin; >+ >+ my $patron = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 1 } } ); >+ my $patron_2 = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 0 } } ); >+ >+ my $message = $builder->build_object( >+ { >+ class => 'Koha::Notice::Messages', >+ value => { borrowernumber => $patron->borrowernumber } >+ } >+ ); >+ >+ my $message_2 = $builder->build_object( >+ { >+ class => 'Koha::Notice::Messages', >+ value => { borrowernumber => $patron_2->borrowernumber } >+ } >+ ); >+ >+ my $nb_messages = Koha::Notice::Messages->count; >+ >+ my $group_1 = Koha::Library::Group->new( { title => 'TEST Group 1' } )->store; >+ my $group_2 = Koha::Library::Group->new( { title => 'TEST Group 2' } )->store; >+ Koha::Library::Group->new({ parent_id => $group_1->id, branchcode => $patron->branchcode })->store(); >+ Koha::Library::Group->new({ parent_id => $group_2->id, branchcode => $patron_2->branchcode })->store(); >+ t::lib::Mocks::mock_userenv( { patron => $patron } ); # Is superlibrarian >+ is( Koha::Notice::Messages->search_limited->count, $nb_messages, 'Koha::Notice::Messages->search_limited should return all generated notices for superlibrarian' ); >+ t::lib::Mocks::mock_userenv( { patron => $patron_2 } ); # Is restricted >+ is( Koha::Notice::Messages->search_limited->count, 1, 'Koha:Notice::Messages->search_limited should not return all generated notices for restricted patron' ); >+}; >+ > 1; >diff --git a/tools/notices.pl b/tools/notices.pl >index 5ac78e81892..a241593636b 100755 >--- a/tools/notices.pl >+++ b/tools/notices.pl >@@ -65,9 +65,9 @@ if ( $op and $op eq 'cud-search' ) { > } > $where{'me.status'} = $status if ($status); > >- my $notices = Koha::Notice::Messages->search( >+ my $notices = Koha::Notice::Messages->search_limited( > {%where}, >- { join => 'borrowernumber', order_by => { -desc => 'time_queued' } } >+ { order_by => { -desc => 'time_queued' } } > ); > > $template->param( >-- >2.46.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 33260
:
148437
|
148438
|
148439
|
148440
|
148943
|
149009
|
149413
|
149581
|
149593
|
149594
|
149595
|
149596
|
149597
|
149598
|
150346
|
150347
|
154927
|
154928
|
157383
|
157384
|
157385
|
157386
|
158852
|
158853
|
158854
|
158855
|
162570
|
162571
|
162572
|
162573
|
162574
|
162624
|
162625
|
162677
|
162678
|
162679
|
162680
|
162681
|
164783
|
164784
|
164785
|
164786
|
164787
|
165238
|
165239
|
165717
|
165939
|
165946
|
165947
|
165948
|
165949
|
165950
|
165951
|
166020
|
166178
|
166335
|
166336
|
166337
|
166338
|
166339
|
166340
|
166341
|
166342
|
166343
|
166344
|
166345
|
166362
|
166363
|
166364
|
166365
|
166366
|
166367
|
166368
|
166369
|
166370
|
166371
|
166372
|
166373
|
167909
|
167910
|
167911
|
167912
|
167913
|
167914
|
167915
|
167916
|
167917
|
167918
|
167919
|
167920
|
172247
|
172248
|
172303
|
172307
|
172308
|
172309
|
172310
|
172311
|
172312
|
172313
|
172314
|
172315
|
172316
|
172317
|
172318
|
172319
|
172320
|
172321
|
172322
|
172342
|
172343
|
172344
|
172345
|
172346
|
172347
|
172348
|
172349
|
172350
|
172351
|
172352
|
172353
|
172354
|
172355
|
172356
|
172357
|
172358
|
172359
|
172379
|
175501
|
175502
|
175503
|
175504
|
175505
|
175506
|
175507
|
175508
|
175509
|
175510
|
175511
|
175512
|
175513
|
175514
|
175515
|
175516
|
175517
|
175518
|
175519
|
175520
|
175521
|
175522
|
175523
|
175524
|
175525
|
175530
|
175537
|
175538
|
175539
|
175540
|
175541
|
175542
|
175543
|
175544
|
175545
|
175546
|
175547
|
175548
|
175549
|
175550
|
175551
|
175552
|
175553
|
175554
|
175555
|
175556
|
175557
|
175558
|
175559
|
175560
|
175561
|
175562
|
175563
|
175730
|
175731
|
175732
|
175733
|
175734
|
175735
|
175736
|
175737
|
175738
|
175739
|
175740
|
175741
|
175742
|
175743
|
175744
|
175745
|
175746
|
175747
|
175748
|
175749
|
175750
|
175751
|
175752
|
175753
|
175754
|
175755
|
175756
|
178733
|
178734
|
178735
|
178736
|
178737
|
178738
|
178739
|
178740
|
178741
|
178742
|
178743
|
178744
|
178745
|
178746
|
178747
|
178748
|
178749
|
178750
|
178751
|
178752
|
178753
|
178754
|
178755
|
178756
|
178757
|
178758
|
178759