Bug 17246 - GetPreparedLetter should not allow multiple FK defined in arrayref
Summary: GetPreparedLetter should not allow multiple FK defined in arrayref
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on: 14757
Blocks:
  Show dependency treegraph
 
Reported: 2016-09-05 09:20 UTC by Jonathan Druart
Modified: 2017-01-03 23:40 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 17246: Do no support arrayref to define multiple FK (3.07 KB, patch)
2016-09-05 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17246: Do no support arrayref to define multiple FK (3.14 KB, patch)
2016-12-10 08:35 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17246: Do no support arrayref to define multiple FK (3.18 KB, patch)
2016-12-23 13:30 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-09-05 09:20:08 UTC
Currently you can call GetPreparedLetter like:

$prepared_letter = GetPreparedLetter(
    (
        module      => 'test',
        letter_code => 'TEST_HOLD',
        tables      => { 
            reserves => [ $fk1, $fk2 ],
        },
    )
);

It assumes that $fk1 is a borrowernumber and $fk2 a biblionumber.
It seems hazardous to do this guess.

I suggest to remove this feature and only allow hashref indeed.
Comment 1 Jonathan Druart 2016-09-05 09:23:16 UTC
Created attachment 55166 [details] [review]
Bug 17246: Do no support arrayref to define multiple FK

Currently you can call GetPreparedLetter like:

$prepared_letter = GetPreparedLetter(
    (
        module      => 'test',
        letter_code => 'TEST_HOLD',
        tables      => {
            reserves => [ $fk1, $fk2 ],
        },
    )
);

It assumes that $fk1 is a borrowernumber and $fk2 a biblionumber.
It seems hazardous to do this guess.

I suggest to remove this feature and only allow hashref indeed.

Test plan:
Use different way to generate letters and make sure you do not reach the croak
Comment 2 Chris Cormack 2016-09-07 01:40:47 UTC
We aren't using this feature anywhere in Koha, except in t/db_dependent/Letters/TemplateToolkit.t

So yes, I agree we should remove it, because it is dangerous and someone may start using it. Testing now
Comment 3 Jonathan Druart 2016-12-05 14:22:19 UTC
Upgrading severity to get attention
Comment 4 Josef Moravec 2016-12-10 08:35:22 UTC
Created attachment 58091 [details] [review]
[SIGNED-OFF] Bug 17246: Do no support arrayref to define multiple FK

Currently you can call GetPreparedLetter like:

$prepared_letter = GetPreparedLetter(
    (
        module      => 'test',
        letter_code => 'TEST_HOLD',
        tables      => {
            reserves => [ $fk1, $fk2 ],
        },
    )
);

It assumes that $fk1 is a borrowernumber and $fk2 a biblionumber.
It seems hazardous to do this guess.

I suggest to remove this feature and only allow hashref indeed.

Test plan:
Use different way to generate letters and make sure you do not reach the croak

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 5 Kyle M Hall 2016-12-23 13:30:29 UTC
Created attachment 58415 [details] [review]
Bug 17246: Do no support arrayref to define multiple FK

Currently you can call GetPreparedLetter like:

$prepared_letter = GetPreparedLetter(
    (
        module      => 'test',
        letter_code => 'TEST_HOLD',
        tables      => {
            reserves => [ $fk1, $fk2 ],
        },
    )
);

It assumes that $fk1 is a borrowernumber and $fk2 a biblionumber.
It seems hazardous to do this guess.

I suggest to remove this feature and only allow hashref indeed.

Test plan:
Use different way to generate letters and make sure you do not reach the croak

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 6 Kyle M Hall 2016-12-28 13:33:00 UTC
Pushed to master for 17.05, thanks Jonathan!
Comment 7 Katrin Fischer 2017-01-03 23:40:51 UTC
This patch has been pushed to 16.11.x, will be in 16.11.02.