View | Details | Raw Unified | Return to bug 28948
Collapse All | Expand All

(-)a/Koha/Library/Allowlist.pm (-22 lines)
Lines 1-22 Link Here
1
package Koha::Patron::Allowlist;
2
3
use Modern::Perl;
4
use parent 'Koha::Allowlist';
5
6
sub load {
7
    my ($self) = @_;
8
    my @public_read = qw(
9
      branchcode     branchname     branchaddress1
10
      branchaddress2 branchaddress3 branchzip
11
      branchcity     branchstate    branchcountry
12
      branchfax      branchemail    branchurl );
13
    $self->add(@public_read);
14
15
    my @staff_read = qw(
16
      branchillemail branchreplyto branchreturnpath
17
      branchip       branchnotes   marcorgcode
18
    );
19
    $self->add(@staff_read) if $self->{interface} eq 'staff';
20
}
21
22
1;
(-)a/Koha/Object.pm (-15 / +3 lines)
Lines 556-576 sub to_api { Link Here
556
    $params //= {};
556
    $params //= {};
557
557
558
    # Remove forbidden attributes if required
558
    # Remove forbidden attributes if required
559
    # FIXME: All modules should have a corresponding allowlist eventually
559
    if( $self->_result->can('get_column_set') ) { #FIXME Temporary measure
560
    my $allowclass = ref($self) . '::Allowlist';
560
        my $set_name = $params->{public} ? 'public_read' : 'staff_read';
561
    if ( can_load( modules => { $allowclass => undef } ) ) {
561
        $json_object = $self->filter({ input => $json_object, column_set => $set_name, log_level => 'debug' });
562
        my $allowlist = $allowclass->new(
563
            { interface => $params->{public} ? 'opac' : 'staff' } );
564
        $allowlist->load;
565
        my $blocked = $allowlist->apply( { input => $json_object } );
566
        Koha::Logger->get->debug(
567
                ref($self)
568
              . "::to_api allowlist blocked fields: "
569
              . (
570
                join ', ',
571
                map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
572
              )
573
        ) if keys %$blocked;
574
    }
562
    }
575
563
576
    my $to_api_mapping = $self->to_api_mapping;
564
    my $to_api_mapping = $self->to_api_mapping;
(-)a/Koha/Schema/Result/Branch.pm (+21 lines)
Lines 901-904 sub koha_objects_class { Link Here
901
    'Koha::Libraries';
901
    'Koha::Libraries';
902
}
902
}
903
903
904
sub get_column_set {
905
    my ( $self, $name ) = @_;
906
    my $column_sets = {
907
        public_read => [qw(
908
            branchcode     branchname     branchaddress1
909
            branchaddress2 branchaddress3 branchzip
910
            branchcity     branchstate    branchcountry
911
            branchfax      branchemail    branchurl
912
        )],
913
        staff_read => [qw(
914
            branchcode     branchname     branchaddress1
915
            branchaddress2 branchaddress3 branchzip
916
            branchcity     branchstate    branchcountry
917
            branchfax      branchemail    branchurl
918
            branchillemail branchreplyto  branchreturnpath
919
            branchip       branchnotes    marcorgcode
920
        )],
921
    };
922
    return $column_sets->{$name} // [];
923
}
924
904
1;
925
1;
(-)a/t/db_dependent/Koha/Object.t (-38 / +13 lines)
Lines 31-37 use Koha::Database; Link Here
31
use Koha::Acquisition::Orders;
31
use Koha::Acquisition::Orders;
32
use Koha::DateUtils qw( dt_from_string );
32
use Koha::DateUtils qw( dt_from_string );
33
use Koha::Libraries;
33
use Koha::Libraries;
34
use Koha::Library::Allowlist;
34
use Koha::Object::ColumnSet;
35
use Koha::Patrons;
35
use Koha::Patrons;
36
use Koha::ApiKeys;
36
use Koha::ApiKeys;
37
37
Lines 376-424 subtest "to_api() tests" => sub { Link Here
376
376
377
    subtest 'unprivileged request tests' => sub {
377
    subtest 'unprivileged request tests' => sub {
378
378
379
        my @all_attrs = Koha::Libraries->columns();
379
        # Create a sample library
380
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
380
        my $library = $builder->build_object({ class => 'Koha::Libraries' });
381
        my $public_attrs = $allowlist->{_entries};
381
382
        my @all_attrs = @{ $library->_columns };
383
        my $public_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('public_read')} };
384
        my $staff_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('staff_read')} };
382
        my $mapping = Koha::Library->to_api_mapping;
385
        my $mapping = Koha::Library->to_api_mapping;
383
386
384
        plan tests => scalar @all_attrs * 2;
387
        plan tests => scalar @all_attrs * 2;
385
388
386
        # Create a sample library
389
        my $public_representation = $library->to_api({ public => 1 });
387
        my $library = $builder->build_object( { class => 'Koha::Libraries' } );
388
389
        my $unprivileged_representation = $library->to_api({ public => 1 });
390
        my $privileged_representation   = $library->to_api;
390
        my $privileged_representation   = $library->to_api;
391
391
392
        foreach my $attr (@all_attrs) {
392
        foreach my $attr (@all_attrs) {
393
            my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;
393
            my $mapped = $mapping->{$attr} // $attr;
394
            if ( defined($mapped) ) {
394
            is( exists $privileged_representation->{$mapped},
395
                ok(
395
                exists $staff_attrs->{$attr}, "Verify $attr in privileged" );
396
                    exists $privileged_representation->{$mapped},
396
            is( exists $public_representation->{$mapped},
397
                    "Attribute '$attr' is present when privileged"
397
                exists $public_attrs->{$attr}, "Verify $attr in public" );
398
                );
399
                if ( exists $public_attrs->{$attr} ) {
400
                    ok(
401
                        exists $unprivileged_representation->{$mapped},
402
                        "Attribute '$attr' is present when public"
403
                    );
404
                }
405
                else {
406
                    ok(
407
                        !exists $unprivileged_representation->{$mapped},
408
                        "Attribute '$attr' is not present when public"
409
                    );
410
                }
411
            }
412
            else {
413
                ok(
414
                    !exists $privileged_representation->{$attr},
415
                    "Unmapped attribute '$attr' is not present when privileged"
416
                );
417
                ok(
418
                    !exists $unprivileged_representation->{$attr},
419
                    "Unmapped attribute '$attr' is not present when public"
420
                );
421
            }
422
        }
398
        }
423
    };
399
    };
424
400
425
- 

Return to bug 28948