| 333 | } |
| 334 | |
| 335 | std::vector<Value> FilterUtility::GetFilterTargets(const QueryDescription& qd, const Dictionary::Ptr& query, const ApiUser::Ptr& user, const String& variableName) |
| 336 | { |
| 337 | std::vector<Value> result; |
| 338 | |
| 339 | TargetProvider::Ptr provider; |
| 340 | |
| 341 | if (qd.Provider) |
| 342 | provider = qd.Provider; |
| 343 | else |
| 344 | provider = new ConfigObjectTargetProvider(); |
| 345 | |
| 346 | FilterExprPermissionChecker::Ptr permissionChecker = new FilterExprPermissionChecker{user}; |
| 347 | auto* permissionFilter = permissionChecker->CheckPermission(qd.Permission); |
| 348 | |
| 349 | Namespace::Ptr permissionFrameNS = new Namespace(); |
| 350 | ScriptFrame permissionFrame(false, permissionFrameNS); |
| 351 | |
| 352 | for (const String& type : qd.Types) { |
| 353 | String attr = type; |
| 354 | boost::algorithm::to_lower(attr); |
| 355 | |
| 356 | if (attr == "type") |
| 357 | attr = "name"; |
| 358 | |
| 359 | if (query && query->Contains(attr)) { |
| 360 | String name = HttpUtility::GetLastParameter(query, attr); |
| 361 | Object::Ptr target = provider->GetTargetByName(type, name); |
| 362 | |
| 363 | if (!FilterUtility::EvaluateFilter(permissionFrame, permissionFilter, target, variableName)) |
| 364 | BOOST_THROW_EXCEPTION(ScriptError("Access denied to object '" + name + "' of type '" + type + "'")); |
| 365 | |
| 366 | result.emplace_back(std::move(target)); |
| 367 | } |
| 368 | |
| 369 | attr = provider->GetPluralName(type); |
| 370 | boost::algorithm::to_lower(attr); |
| 371 | |
| 372 | if (query && query->Contains(attr)) { |
| 373 | Array::Ptr names = query->Get(attr); |
| 374 | if (names) { |
| 375 | ObjectLock olock(names); |
| 376 | for (String name : names) { |
| 377 | Object::Ptr target = provider->GetTargetByName(type, name); |
| 378 | |
| 379 | if (!FilterUtility::EvaluateFilter(permissionFrame, permissionFilter, target, variableName)) |
| 380 | BOOST_THROW_EXCEPTION(ScriptError("Access denied to object '" + name + "' of type '" + type + "'")); |
| 381 | |
| 382 | result.emplace_back(std::move(target)); |
| 383 | } |
| 384 | } |
| 385 | } |
| 386 | } |
| 387 | |
| 388 | if ((query && query->Contains("filter")) || result.empty()) { |
| 389 | if (!query->Contains("type")) |
| 390 | BOOST_THROW_EXCEPTION(std::invalid_argument("Type must be specified when using a filter.")); |
| 391 | |
| 392 | String type = HttpUtility::GetLastParameter(query, "type"); |
nothing calls this directly
no test coverage detected