Lines 229-269
Merges parameters from $q_params into $filtered_params.
Link Here
|
229 |
|
229 |
|
230 |
=head3 stash_embed |
230 |
=head3 stash_embed |
231 |
|
231 |
|
232 |
$c->stash_embed( $c->match->endpoint->pattern->defaults->{'openapi.op_spec'} ); |
232 |
$c->stash_embed( ); |
233 |
|
233 |
|
234 |
=cut |
234 |
=cut |
235 |
|
235 |
|
236 |
$app->helper( |
236 |
$app->helper( |
237 |
'stash_embed' => sub { |
237 |
'stash_embed' => sub { |
238 |
|
238 |
|
239 |
my ( $c, $args ) = @_; |
239 |
my ( $c ) = @_; |
240 |
|
|
|
241 |
my $spec = $args->{spec} // {}; |
242 |
|
240 |
|
243 |
my $embed_spec; |
241 |
# FIXME: This routine is currently called from Auth, and only Auth, |
244 |
for my $param (@{$spec->{parameters}}) { |
242 |
# and is prior to OpenAPI validation. As such, we cannot use the |
245 |
next unless $param->{name} eq 'x-koha-embed'; |
243 |
# validated output of OpenAPI yet and thus have to fetch and split |
246 |
$embed_spec = $param->{items}->{enum}; |
244 |
# the headers ourselves. Validation takes place as the first step in |
247 |
} |
245 |
# the controllers and will varify the header again at this point. |
248 |
my $embed_header = $c->req->headers->header('x-koha-embed'); |
246 |
my $embed_header = $c->req->headers->header('x-koha-embed'); |
249 |
|
247 |
if ($embed_header) { |
250 |
Koha::Exceptions::BadParameter->throw("Embedding objects is not allowed on this endpoint.") |
|
|
251 |
if $embed_header and !defined $embed_spec; |
252 |
|
253 |
if ( $embed_header ) { |
254 |
my $THE_embed = {}; |
248 |
my $THE_embed = {}; |
255 |
foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { |
249 |
foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { |
256 |
my $matches = grep {lc $_ eq lc $embed_req} @{ $embed_spec }; |
250 |
_merge_embed( _parse_embed($embed_req), $THE_embed ); |
257 |
|
|
|
258 |
Koha::Exceptions::BadParameter->throw( |
259 |
error => 'Embeding '.$embed_req. ' is not authorised. Check your x-koha-embed headers or remove it.' |
260 |
) unless $matches; |
261 |
|
262 |
_merge_embed( _parse_embed($embed_req), $THE_embed); |
263 |
} |
251 |
} |
264 |
|
252 |
|
265 |
$c->stash( 'koha.embed' => $THE_embed ) |
253 |
$c->stash( 'koha.embed' => $THE_embed ) |
266 |
if $THE_embed; |
254 |
if $THE_embed; |
267 |
} |
255 |
} |
268 |
|
256 |
|
269 |
return $c; |
257 |
return $c; |