Commit 3b0e3d55 authored by Romain Courteaud's avatar Romain Courteaud

erp5_hal_json_style: forbid querying unknown catalog column

parent 25ecc376
......@@ -1727,6 +1727,19 @@ def calculateHateoas(is_portal=None, is_site_root=None, traversed_document=None,
byteify(
json.loads(urlsafe_b64decode(default_param_json)))))
if query:
# Forbid querying unknown catalog column
invalid_column_list = []
def isValidColumnOrRaise(column_id):
is_valid_column = sql_catalog.isValidColumn(column_id)
if not is_valid_column:
invalid_column_list.append(column_id)
return is_valid_column
sql_catalog.parseSearchText(query, search_key='FullTextKey', is_valid=isValidColumnOrRaise)
if invalid_column_list:
response.setStatus(400)
result_dict["_debug"] = 'Invalid column name: %s' % str(invalid_column_list)
return result_dict
catalog_kw["full_text"] = query
if selection_domain is not None:
......
......@@ -1432,6 +1432,34 @@ class TestERP5Document_getHateoas_mode_search(ERP5HALJSONStyleSkinsMixin):
# No count if not in the listbox context currently
self.assertEqual(result_dict['_embedded'].get('count', None), None)
@simulate('Base_getRequestUrl', '*args, **kwargs', 'return "http://example.org/bar"')
@simulate('Base_getRequestHeader', '*args, **kwargs', 'return "application/hal+json"')
@simulate('Test_listCatalog', '*args, **kwargs', "return []")
@changeSkin('Hal')
def test_getHateoas_query_param_reject_unknown_column(self, **kw):
"""Check that listbox line calculation modify the selection
"""
self.portal.foo_module.FooModule_viewFooList.listbox.ListBox_setPropertyList(
field_count_method = '')
selection_tool = self.portal.portal_selections
selection_name = self.portal.foo_module.FooModule_viewFooList.listbox.get_value('selection_name')
selection_tool.setSelectionFor(selection_name, Selection(selection_name))
# Create the listbox selection
fake_request = do_fake_request("GET")
result = self.portal.web_site_module.hateoas.ERP5Document_getHateoas(
REQUEST=fake_request,
mode="search",
query='bar:"foo"'
)
self.assertEquals(fake_request.RESPONSE.status, 400)
self.assertEquals(fake_request.RESPONSE.getHeader('Content-Type'),
"application/hal+json"
)
result_dict = json.loads(result)
self.assertEqual(result_dict['_debug'], "Invalid column name: ['bar', 'bar']")
@simulate('Base_getRequestUrl', '*args, **kwargs',
'return "http://example.org/bar"')
@simulate('Base_getRequestHeader', '*args, **kwargs',
......@@ -2231,7 +2259,7 @@ return context.getPortalObject().portal_catalog(portal_type='Foo', sort_on=[('id
REQUEST=fake_request,
mode="search",
local_roles=["Manager"],
query='bar:"foo"',
query='id:"foo"',
list_method='Test_listCatalog',
select_list=['title', 'uid'],
selection_domain=json.dumps({'foo_domain': 'a/a1', 'foo_category': 'a/a2'}),
......@@ -2250,7 +2278,7 @@ return context.getPortalObject().portal_catalog(portal_type='Foo', sort_on=[('id
self.assertEquals(
selection.getParams(), {
'local_roles': ['Manager'],
'full_text': 'bar:"foo"',
'full_text': 'id:"foo"',
'ignore_unknown_columns': True,
'portal_type': ['Foo'],
'limit': 1000
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment