View | Details | Raw Unified | Return to bug 28948
Collapse All | Expand All

(-)a/Koha/Library.pm (-15 lines)
Lines 266-286 sub validate_hold_sibling { Link Here
266
      ->count > 0;
266
      ->count > 0;
267
}
267
}
268
268
269
=head3 public_read_list
270
271
This method returns the list of publically readable database fields for both API and UI output purposes
272
273
=cut
274
275
sub public_read_list {
276
    return [
277
        'branchcode',     'branchname',     'branchaddress1',
278
        'branchaddress2', 'branchaddress3', 'branchzip',
279
        'branchcity',     'branchstate',    'branchcountry',
280
        'branchfax',      'branchemail',    'branchurl'
281
    ];
282
}
283
284
=head3 to_api_mapping
269
=head3 to_api_mapping
285
270
286
This method returns the mapping for representing a Koha::Library object
271
This method returns the mapping for representing a Koha::Library object
(-)a/Koha/Library/Allowlist.pm (+22 lines)
Line 0 Link Here
1
package Koha::Patron::Allowlist;
2
3
use Modern::Perl;
4
use parent 'Koha::Allowlist';
5
6
sub load {
7
    my ($self) = @_;
8
    my @public_read = qw(
9
      branchcode     branchname     branchaddress1
10
      branchaddress2 branchaddress3 branchzip
11
      branchcity     branchstate    branchcountry
12
      branchfax      branchemail    branchurl );
13
    $self->add(@public_read);
14
15
    my @staff_read = qw(
16
      branchillemail branchreplyto branchreturnpath
17
      branchip       branchnotes   marcorgcode
18
    );
19
    $self->add(@staff_read) if $self->{interface} eq 'staff';
20
}
21
22
1;
(-)a/Koha/Object.pm (-8 / +17 lines)
Lines 24-30 use Carp qw( croak ); Link Here
24
use Mojo::JSON;
24
use Mojo::JSON;
25
use Scalar::Util qw( blessed looks_like_number );
25
use Scalar::Util qw( blessed looks_like_number );
26
use Try::Tiny qw( catch try );
26
use Try::Tiny qw( catch try );
27
use List::MoreUtils qw( any );
27
use Module::Load::Conditional qw( can_load );
28
28
29
use Koha::Database;
29
use Koha::Database;
30
use Koha::Exceptions::Object;
30
use Koha::Exceptions::Object;
Lines 552-566 Returns a representation of the object, suitable for API output. Link Here
552
sub to_api {
552
sub to_api {
553
    my ( $self, $params ) = @_;
553
    my ( $self, $params ) = @_;
554
    my $json_object = $self->TO_JSON;
554
    my $json_object = $self->TO_JSON;
555
    $params //= {};
555
556
556
    # Remove forbidden attributes if required
557
    # Remove forbidden attributes if required
557
    # FIXME: We should eventually require public_read_list in all objects and drop the conditional here.
558
    # FIXME: All modules should have a corresponding allowlist eventually
558
    if (    $params->{public}
559
    my $allowclass = ref($self) . '::Allowlist';
559
        and $self->can('public_read_list') )
560
    if ( can_load( modules => { $allowclass => undef } ) ) {
560
    {
561
        my $allowlist = $allowclass->new(
561
        for my $field ( keys %{$json_object} ) {
562
            { interface => $params->{public} ? 'opac' : 'staff' } );
562
            delete $json_object->{$field} unless any { $_ eq $field } @{$self->public_read_list};
563
        $allowlist->load;
563
        }
564
        my $blocked = $allowlist->apply( { input => $json_object } );
565
        Koha::Logger->get->debug(
566
                ref($self)
567
              . "::to_api allowlist blocked fields: "
568
              . (
569
                join ', ',
570
                map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
571
              )
572
        ) if keys %$blocked;
564
    }
573
    }
565
574
566
    my $to_api_mapping = $self->to_api_mapping;
575
    my $to_api_mapping = $self->to_api_mapping;
(-)a/t/db_dependent/Koha/Object.t (-1 / +3 lines)
Lines 31-36 use Koha::Database; Link Here
31
use Koha::Acquisition::Orders;
31
use Koha::Acquisition::Orders;
32
use Koha::DateUtils qw( dt_from_string );
32
use Koha::DateUtils qw( dt_from_string );
33
use Koha::Libraries;
33
use Koha::Libraries;
34
use Koha::Library::Allowlist;
34
use Koha::Patrons;
35
use Koha::Patrons;
35
use Koha::ApiKeys;
36
use Koha::ApiKeys;
36
37
Lines 376-382 subtest "to_api() tests" => sub { Link Here
376
    subtest 'unprivileged request tests' => sub {
377
    subtest 'unprivileged request tests' => sub {
377
378
378
        my @all_attrs = Koha::Libraries->columns();
379
        my @all_attrs = Koha::Libraries->columns();
379
        my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } };
380
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
381
        my $public_attrs = $allowlist->{_entries};
380
        my $mapping = Koha::Library->to_api_mapping;
382
        my $mapping = Koha::Library->to_api_mapping;
381
383
382
        plan tests => scalar @all_attrs * 2;
384
        plan tests => scalar @all_attrs * 2;
(-)a/t/db_dependent/Koha/Objects.t (-2 / +3 lines)
Lines 32-37 use Koha::Biblios; Link Here
32
use Koha::Patron::Category;
32
use Koha::Patron::Category;
33
use Koha::Patron::Categories;
33
use Koha::Patron::Categories;
34
use Koha::Patrons;
34
use Koha::Patrons;
35
use Koha::Library::Allowlist;
35
use Koha::Database;
36
use Koha::Database;
36
use Koha::DateUtils qw( dt_from_string );
37
use Koha::DateUtils qw( dt_from_string );
37
38
Lines 401-407 subtest "to_api() tests" => sub { Link Here
401
    subtest 'unprivileged request tests' => sub {
402
    subtest 'unprivileged request tests' => sub {
402
403
403
        my @all_attrs = Koha::Libraries->columns();
404
        my @all_attrs = Koha::Libraries->columns();
404
        my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } };
405
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
406
        my $public_attrs = $allowlist->{_entries};
405
        my $mapping = Koha::Library->to_api_mapping;
407
        my $mapping = Koha::Library->to_api_mapping;
406
408
407
        # Create sample libraries
409
        # Create sample libraries
408
- 

Return to bug 28948