View | Details | Raw Unified | Return to bug 30536
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Query.pm (-22 / +10 lines)
Lines 229-269 Merges parameters from $q_params into $filtered_params. Link Here
229
229
230
=head3 stash_embed
230
=head3 stash_embed
231
231
232
    $c->stash_embed( $c->match->endpoint->pattern->defaults->{'openapi.op_spec'} );
232
    $c->stash_embed( );
233
233
234
=cut
234
=cut
235
235
236
    $app->helper(
236
    $app->helper(
237
        'stash_embed' => sub {
237
        'stash_embed' => sub {
238
238
239
            my ( $c, $args ) = @_;
239
            my ( $c ) = @_;
240
241
            my $spec = $args->{spec} // {};
242
240
243
            my $embed_spec;
241
            # FIXME: This routine is currently called from Auth, and only Auth,
244
            for my $param (@{$spec->{parameters}}) {
242
            # and is prior to OpenAPI validation. As such, we cannot use the
245
                next unless $param->{name} eq 'x-koha-embed';
243
            # validated output of OpenAPI yet and thus have to fetch and split
246
                $embed_spec = $param->{items}->{enum};
244
            # the headers ourselves. Validation takes place as the first step in
247
            }
245
            # the controllers and will varify the header again at this point.
248
            my $embed_header = $c->req->headers->header('x-koha-embed');
246
            my $embed_header = $c->req->headers->header('x-koha-embed');
249
247
            if ($embed_header) {
250
            Koha::Exceptions::BadParameter->throw("Embedding objects is not allowed on this endpoint.")
251
                if $embed_header and !defined $embed_spec;
252
253
            if ( $embed_header ) {
254
                my $THE_embed = {};
248
                my $THE_embed = {};
255
                foreach my $embed_req ( split /\s*,\s*/, $embed_header ) {
249
                foreach my $embed_req ( split /\s*,\s*/, $embed_header ) {
256
                    my $matches = grep {lc $_ eq lc $embed_req} @{ $embed_spec };
250
                    _merge_embed( _parse_embed($embed_req), $THE_embed );
257
258
                    Koha::Exceptions::BadParameter->throw(
259
                        error => 'Embeding '.$embed_req. ' is not authorised. Check your x-koha-embed headers or remove it.'
260
                    ) unless $matches;
261
262
                    _merge_embed( _parse_embed($embed_req), $THE_embed);
263
                }
251
                }
264
252
265
                $c->stash( 'koha.embed' => $THE_embed )
253
                $c->stash( 'koha.embed' => $THE_embed )
266
                    if $THE_embed;
254
                  if $THE_embed;
267
            }
255
            }
268
256
269
            return $c;
257
            return $c;
(-)a/Koha/REST/V1/Auth.pm (-2 / +1 lines)
Lines 157-163 sub authenticate_api_request { Link Here
157
    # TODO: remove the latter 'openapi.op_spec' if minimum version is bumped to at least 1.17.
157
    # TODO: remove the latter 'openapi.op_spec' if minimum version is bumped to at least 1.17.
158
    my $spec = $c->openapi->spec || $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
158
    my $spec = $c->openapi->spec || $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
159
159
160
    $c->stash_embed({ spec => $spec });
160
    $c->stash_embed();
161
    $c->stash_overrides();
161
    $c->stash_overrides();
162
162
163
    my $cookie_auth = 0;
163
    my $cookie_auth = 0;
164
- 

Return to bug 30536