From ac0fda119497a6d0f85d38b2f90f257968eedbf4 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Fri, 3 Sep 2021 09:33:00 +0000 Subject: [PATCH] Bug 28935: Apply module changes to controller scripts Content-Type: text/plain; charset=utf-8 Test plan: Add an unallowed field to the submit with dom inspector in opac or staff. Check if it is ignored and if log contains one warning. Signed-off-by: Marcel de Rooy --- members/memberentry.pl | 6 +++--- opac/opac-memberentry.pl | 14 +++++++++----- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/members/memberentry.pl b/members/memberentry.pl index 509b5ac19e..227792c13a 100755 --- a/members/memberentry.pl +++ b/members/memberentry.pl @@ -48,8 +48,8 @@ use Email::Valid; use Koha::SMS::Providers; use Koha::Patron::Allowlist; -my $ui_allowlist = Koha::Patron::Allowlist->new({ interface => 'staff' }); - +my $allowlist = Koha::Patron::Allowlist->new({ interface => 'staff' }); +$allowlist->load; my $input = CGI->new; my %data; @@ -434,7 +434,7 @@ if ( defined $sms ) { $newdata{smsalertnumber} = $sms; } -$ui_allowlist->apply({ input => \%newdata }); +my $blocked = $allowlist->apply({ input => \%newdata, verbose => 1 }); # TODO Should we log results in $blocked ? ### Error checks should happen before this line. $nok = $nok || scalar(@errors); diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl index 3c3d9434ae..e8e9688b19 100755 --- a/opac/opac-memberentry.pl +++ b/opac/opac-memberentry.pl @@ -48,7 +48,8 @@ use Koha::AuthorisedValues; use Koha::Patron::Allowlist; -my $ui_allowlist = Koha::Patron::Allowlist->new(); +my $allowlist = Koha::Patron::Allowlist->new; +$allowlist->load; my $cgi = CGI->new; my $dbh = C4::Context->dbh; @@ -136,7 +137,8 @@ if ( $action eq 'create' ) { delete $borrower{'password2'}; my @unwanted_fields = split( /\|/, C4::Context->preference('PatronSelfRegistrationBorrowerUnwantedField') || q|| ); - $ui_allowlist->apply({ input => \%borrower, additional_deny_list => \@unwanted_fields }); + $allowlist->remove( @unwanted_fields ); + my $blocked = $allowlist->apply({ input => \%borrower, verbose => 1 }); # TODO Log blocked data ? my $cardnumber_error_code; if ( !grep { $_ eq 'cardnumber' } @empty_mandatory_fields ) { @@ -272,12 +274,14 @@ elsif ( $action eq 'update' ) { ( CheckMandatoryFields( \%borrower, $action ), CheckMandatoryAttributes( \%borrower, $attributes ) ); my $invalidformfields = CheckForInvalidFields(\%borrower); + my @unwanted_fields = split( /\|/, C4::Context->preference('PatronSelfModificationBorrowerUnwantedField') || q|| ); + $allowlist->remove( @unwanted_fields ); + $allowlist->add( 'borrowernumber' ); # added because inserted after ParseCgi call + my $blocked = $allowlist->apply({ input => \%borrower, verbose => 1 }); # TODO Log blocked data ? + # Send back the data to the template %borrower = ( %$borrower, %borrower ); - my @unwanted_fields = split( /\|/, C4::Context->preference('PatronSelfModificationBorrowerUnwantedField') || q|| ); - $ui_allowlist->apply({ input => \%borrower, additional_deny_list => \@unwanted_fields }); - if (@empty_mandatory_fields || @$invalidformfields) { $template->param( empty_mandatory_fields => \@empty_mandatory_fields, -- 2.20.1