From 5daf7bf7da05f6f9c6cccf1e3b01c667b950a221 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Fri, 11 Oct 2024 09:42:03 +0000 Subject: [PATCH] Bug 37041: Add C4::Auth::check_value_builder_caller Content-Type: text/plain; charset=utf-8 Test plan: Run t/db_dependent/FrameworkPlugin.t Run xt/find-missing-auth_checks.t Signed-off-by: Marcel de Rooy --- C4/Auth.pm | 37 +++++++++++++++++++++++++++++++++++ xt/find-missing-auth_checks.t | 2 +- 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index d4b83bb75e..c799eb86c4 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -2392,6 +2392,43 @@ sub getborrowernumber { return 0; } +=head2 check_value_builder_caller + + C4::Auth::check_value_builder_caller(); + my $check = C4::Auth::check_value_builder_caller{ { exit => 0 } ); + + A value builder plugin should be called (with do $file) from + Koha::FrameworkPlugin. (Used by plugin_launcher, form builders, + a.o.) In that case we will return 1. + In all other case like someone trying to hit a value builder plugin + directly, we may return false or exit with a 403 immediately (based + on the exit parameter). + + NOTE: If exit is not passed, it defaults to 1! + +=cut + +sub check_value_builder_caller { + my ($params) = @_; + my $exit = $params->{exit} // 1; + + my $callers; + $callers->[0] = [ caller(0) ]; + if ( $callers->[0]->[1] =~ /\/cataloguing\/value_builder\// ) { + + # Need to check call stack + $callers->[1] = [ caller(1) ]; + return 1 if $callers->[1]->[1] =~ /\/Koha\/FrameworkPlugin\.pm$/; + } + + if ($exit) { + require CGI; + print CGI->new->header( -type => 'text/plain', -status => '403 Forbidden' ); + safe_exit; + } + return; +} + END { } # module clean-up code here (global destructor) 1; __END__ diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t index a1a5c0d594..e3c929989c 100755 --- a/xt/find-missing-auth_checks.t +++ b/xt/find-missing-auth_checks.t @@ -32,7 +32,7 @@ FILE: foreach my $file (@files) { chomp $file; my @lines = read_file($file); for my $line (@lines) { - for my $routine (qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init )) { + for my $routine (qw( get_template_and_user check_cookie_auth checkauth check_api_auth check_value_builder_caller C4::Service->init )) { next FILE if $line =~ m|^[^#]*$routine|; } } -- 2.39.5