From a37cb589c443b4184104b133b681933f60a97835 Mon Sep 17 00:00:00 2001
From: Hammat Wele <hammat.wele@inlibro.com>
Date: Thu, 13 Jun 2024 16:31:50 +0000
Subject: [PATCH] Bug 37018: (follow-up) stop the execution when invalid query

prove t/Koha/REST/Plugin/Query.t should return OK, returning 400 when invalid operator is found
---
 Koha/REST/Plugin/Query.pm  |  5 +++--
 t/Koha/REST/Plugin/Query.t | 25 ++++++++++++++++++-------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm
index a4160ac7d2..becc5419ef 100644
--- a/Koha/REST/Plugin/Query.pm
+++ b/Koha/REST/Plugin/Query.pm
@@ -199,14 +199,15 @@ Validate operators in the passed query.
     $app->helper(
         'dbic_validate_operators' => sub {
             my ( $c, $args ) = @_;
-            return try {
+            try {
                 _validate_query( $args->{filtered_params} );
             } catch {
                 if ( blessed $_ && $_->isa('Koha::Exceptions::BadParameter') ) {
-                    return $c->render(
+                    $c->render(
                         status  => 400,
                         json => { error => $_->error }
                     );
+                    Koha::Exceptions::BadParameter->throw( $_->error );
                 }
             };
         }
diff --git a/t/Koha/REST/Plugin/Query.t b/t/Koha/REST/Plugin/Query.t
index 477df53dc5..55385ac237 100755
--- a/t/Koha/REST/Plugin/Query.t
+++ b/t/Koha/REST/Plugin/Query.t
@@ -207,13 +207,21 @@ get '/build_query' => sub {
 };
 
 get '/dbic_validate_operators' => sub {
-    my ( $c, $args ) = @_;
+    my ( $c ) = @_;
 
-    my $query = $c->req->json->{q};
+	try {
+		my $query = $c->req->json->{q};
 
-    $c->dbic_validate_operators({ filtered_params => $query });
+		$c->dbic_validate_operators({ filtered_params => $query });
 
-    $c->render( json => { filtered_params => $query }, status => 200 );
+		$c->render( json => { filtered_params => $query }, status => 200 );
+    }
+    catch {
+        $c->render(
+			status => 400,
+            json   => { error => "$_" }
+        );
+    };
 };
 
 get '/stash_embed' => sub {
@@ -646,7 +654,7 @@ subtest 'dbic_extended_attributes_join() tests' => sub {
 };
 
 subtest 'dbic_validate_operators' => sub {
-    plan tests => 16;
+    plan tests => 17;
 
     my $t = Test::Mojo->new;
 
@@ -680,6 +688,9 @@ subtest 'dbic_validate_operators' => sub {
 
     # Invalid queries
     $q = [ { "-and" => [ [ { "biblio_id" => { "like(sleep(1/100000))or" => "%a%" } } ] ] } ];
-    $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )->status_is(400);
-
+    $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )
+		->status_is(400)
+		->json_is( '/error' =>
+			qq{Exception 'Koha::Exceptions::BadParameter' thrown 'Invalid operator in query: like(sleep(1/100000))or'\n}
+		);
 };
-- 
2.34.1