From 110408531357f10961e97f46074bab857f993687 Mon Sep 17 00:00:00 2001
From: David Gustafsson <david.gustafsson@ub.gu.se>
Date: Tue, 3 Mar 2020 14:32:31 +0100
Subject: [PATCH] Bug 24788: Remove autoloaded column accessors in
 Koha::Object->store

Columns are accessed as methods, relying on AUTOLOAD, in
Koha::Object->store. This has security implications and could also be a
source of strange bugs.

To test:

1) Apply patches for Bug 14957
2) Follow the testing instructions, when saving a new marc rule and
error is thrown.
3) Apply patch
4) Try saving a new rule once again, this should now work
---
 Koha/Object.pm | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/Koha/Object.pm b/Koha/Object.pm
index 694835e238..86cfc1299f 100644
--- a/Koha/Object.pm
+++ b/Koha/Object.pm
@@ -129,24 +129,26 @@ sub store {
         # Integers
         if ( _numeric_column_type( $columns_info->{$col}->{data_type} ) ) {
             # Has been passed but not a number, usually an empty string
-            if ( defined $self->$col and not looks_like_number( $self->$col ) ) {
+            my $value = $self->_result()->get_column($col);
+            if ( defined $value and not looks_like_number( $value ) ) {
                 if ( $columns_info->{$col}->{is_nullable} ) {
                     # If nullable, default to null
-                    $self->$col(undef);
+                    $self->_result()->set_column($col => undef);
                 } else {
                     # If cannot be null, get the default value
                     # What if cannot be null and does not have a default value? Possible?
-                    $self->$col($columns_info->{$col}->{default_value});
+                    $self->_result()->set_column($col => $columns_info->{$col}->{default_value});
                 }
             }
         }
         elsif ( _date_or_datetime_column_type( $columns_info->{$col}->{data_type} ) ) {
             # Set to null if an empty string (or == 0 but should not happen)
-            if ( defined $self->$col and not $self->$col ) {
+            my $value = $self->_result()->get_column($col);
+            if ( defined $value and not $value ) {
                 if ( $columns_info->{$col}->{is_nullable} ) {
-                    $self->$col(undef);
+                    $self->_result()->set_column($col => undef);
                 } else {
-                    $self->$col($columns_info->{$col}->{default_value});
+                    $self->_result()->set_column($col => $columns_info->{$col}->{default_value});
                 }
             }
         }
-- 
2.25.0