View | Details | Raw Unified | Return to bug 17428
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-12 / +21 lines)
Lines 91-104 sub authenticate_api_request { Link Here
91
        ) if $cookie and $action_spec->{'x-koha-authorization'};
91
        ) if $cookie and $action_spec->{'x-koha-authorization'};
92
    }
92
    }
93
93
94
    # Check for malformed query parameters
94
    my @errors = validate_parameters( $c, $action_spec );
95
    my @errors;
95
    return $c->render_swagger({}, \@errors, 400) if @errors;
96
    my %valid_parameters = map { $_->{name} => 1 if $_->{in} eq 'query' } @{$action_spec->{parameters}};
97
    my $existing_params = $c->req->query_params->to_hash;
98
    for my $param ( keys %{$existing_params} ) {
99
      push @errors, { path => "/query/".$param, message => 'Malformed query string' } unless exists $valid_parameters{$param};
100
    }
101
    return $c->render_swagger({},\@errors,400) if @errors;
102
96
103
    return $next->($c) unless $action_spec->{'x-koha-authorization'};
97
    return $next->($c) unless $action_spec->{'x-koha-authorization'};
104
    unless ($user) {
98
    unless ($user) {
Lines 107-115 sub authenticate_api_request { Link Here
107
101
108
    my $authorization = $action_spec->{'x-koha-authorization'};
102
    my $authorization = $action_spec->{'x-koha-authorization'};
109
    my $permissions = $authorization->{'permissions'};
103
    my $permissions = $authorization->{'permissions'};
110
    return $next->($c) if C4::Auth::haspermission($user->userid, $permissions);
104
    if ( C4::Auth::haspermission($user->userid, $permissions)
111
    return $next->($c) if allow_owner($c, $authorization, $user);
105
        or allow_owner($c, $authorization, $user)
112
    return $next->($c) if allow_guarantor($c, $authorization, $user);
106
        or allow_guarantor($c, $authorization, $user) ) {
107
        return $next->($c)
108
    }
113
    return $c->render_swagger(
109
    return $c->render_swagger(
114
        { error => "Authorization failure. Missing required permission(s).",
110
        { error => "Authorization failure. Missing required permission(s).",
115
          required_permissions => $permissions },
111
          required_permissions => $permissions },
Lines 118-123 sub authenticate_api_request { Link Here
118
    );
114
    );
119
}
115
}
120
116
117
sub validate_parameters {
118
    my ( $c, $action_spec ) = @_;
119
120
    # Check for malformed query parameters
121
    my @errors;
122
    my %valid_parameters = map { ( $_->{in} eq 'query' ) ? ( $_->{name} => 1 ) : () } @{ $action_spec->{parameters} };
123
    my $existing_params = $c->req->query_params->to_hash;
124
    for my $param ( keys %{$existing_params} ) {
125
        push @errors, { path => "/query/" . $param, message => 'Malformed query string' } unless exists $valid_parameters{$param};
126
    }
127
    return @errors;
128
}
129
130
121
=head3 allow_owner
131
=head3 allow_owner
122
132
123
Allows access to object for its owner.
133
Allows access to object for its owner.
124
- 

Return to bug 17428