gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 32713: Throw exception on unexpected x-koha-embed header 

This patch adds an exception to stash_embed that is thrown when we
find an x-koha-embed header that we're not expecting.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This commit is contained in:
Martin Renvoize 2023-03-01 16:42:30 +00:00 committed by Tomas Cohen Arazi
parent 2202f7f2c2
commit 33de3ef9dc
No known key found for this signature in database
GPG Key ID: 0A272EA1B2F3C15F
2 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Koha/REST/Plugin/Query.pm
View File

@ -228,7 +228,7 @@ Merges parameters from $q_params into $filtered_params.
=head3 stash_embed
$c->stash_embed();
$c->stash_embed( { spec => $op_spec } );
Unwraps and stashes the x-koha-embed headers for use later query construction
@ -237,14 +237,28 @@ Unwraps and stashes the x-koha-embed headers for use later query construction
$app->helper(
'stash_embed' => sub {
my ( $c ) = @_;
my ( $c, $args ) = @_;
my $embed_header = $c->req->headers->header('x-koha-embed');
return $c unless $embed_header;
my $spec = $args->{spec} // {};
my $embed_spec;
for my $param ( @{ $spec->{parameters} } ) {
next unless $param->{name} eq 'x-koha-embed';
$embed_spec = $param->{items}->{enum};
}
Koha::Exceptions::BadParameter->throw(
"Embedding objects is not allowed on this endpoint.")
unless defined($embed_spec);
if ($embed_header) {
my $THE_embed = {};
foreach my $embed_req ( split /\s*,\s*/, $embed_header ) {
if ( $embed_req eq '+strings' ) { # special case
$c->stash( 'koha.strings' => 1 );
} else {
}
else {
_merge_embed( _parse_embed($embed_req), $THE_embed );
}
}

2
Koha/REST/V1/Auth.pm
View File

@ -157,7 +157,7 @@ sub authenticate_api_request {
# TODO: remove the latter 'openapi.op_spec' if minimum version is bumped to at least 1.17.
my $spec = $c->openapi->spec || $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
$c->stash_embed();
$c->stash_embed( { spec => $spec } );
$c->stash_overrides();
my $cookie_auth = 0;