[Catalyst-commits] r9712 - in
Catalyst-Controller-DBIC-API/1.003/branches/prefetch: .
lib/Catalyst/Controller/DBIC lib/Catalyst/Controller/DBIC/API
abraxxa at dev.catalyst.perl.org
abraxxa at dev.catalyst.perl.org
Thu Apr 16 17:02:33 GMT 2009
Author: abraxxa
Date: 2009-04-16 18:02:32 +0100 (Thu, 16 Apr 2009)
New Revision: 9712
Modified:
Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Changes
Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Makefile.PL
Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API.pm
Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API/Base.pm
Log:
Added prefetch support (+pod -tests)
Modified: Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Changes
===================================================================
--- Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Changes 2009-04-16 09:32:40 UTC (rev 9711)
+++ Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Changes 2009-04-16 17:02:32 UTC (rev 9712)
@@ -1,5 +1,8 @@
Revision history for Catalyst-Controller-DBIC-API
+1.003000
+- Added prefetch support
+
1.002000
- Better error handing when unable to parse search arg
- Added setup_dbic_args_method config option
Modified: Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Makefile.PL
===================================================================
--- Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Makefile.PL 2009-04-16 09:32:40 UTC (rev 9711)
+++ Catalyst-Controller-DBIC-API/1.003/branches/prefetch/Makefile.PL 2009-04-16 17:02:32 UTC (rev 9712)
@@ -9,6 +9,7 @@
requires 'Catalyst::Action::REST' => 0.60;
requires 'CGI::Expand' => 2.02;
requires 'JSON::Any' => 1.19;
+requires 'Test::Deep' => 0.104;
build_requires 'Test::More' => 0.7;
build_requires 'Catalyst::Model::DBIC::Schema' => 0.20;
Modified: Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API/Base.pm
===================================================================
--- Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API/Base.pm 2009-04-16 09:32:40 UTC (rev 9711)
+++ Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API/Base.pm 2009-04-16 17:02:32 UTC (rev 9712)
@@ -7,10 +7,17 @@
use DBIx::Class::ResultClass::HashRefInflator;
use JSON::Any;
+use Test::Deep::NoTest;
-__PACKAGE__->mk_accessors(qw(
- class create_requires update_requires update_allows $self->rs_stash_key create_allows list_count list_returns list_grouped_by list_search_exposes list_ordered_by rs_stash_key object_stash_key setup_list_method setup_dbic_args_method
- ));
+__PACKAGE__->mk_accessors(qw/
+ class create_requires
+ update_requires update_allows
+ create_allows
+ list_count list_returns list_prefetch list_prefetch_allows
+ list_grouped_by list_search_exposes list_ordered_by
+ rs_stash_key object_stash_key
+ setup_list_method setup_dbic_args_method
+/);
__PACKAGE__->config(
class => undef,
@@ -19,6 +26,8 @@
update_requires => [],
update_allows => [],
list_returns => [],
+ list_prefetch => undef,
+ list_prefetch_allows => [],
list_grouped_by => [],
list_search_exposes => [],
list_ordered_by => [],
@@ -47,6 +56,23 @@
sub generate_dbic_search_args :Private {
my ($self, $c) = @_;
+
+ my $args = {};
+ # do this before eventually calling expand_hash
+ my $prefetch = (exists $c->req->params->{list_prefetch} ? JSON::Any->from_json($c->req->params->{list_prefetch}) : undef) || ($self->list_prefetch ? $self->list_prefetch : undef);
+ if ($prefetch) {
+ # validate the prefetch param against list_prefetch_allows
+ foreach my $prefetch_allows (@{$self->list_prefetch_allows}) {
+ if (eq_deeply($prefetch, $prefetch_allows)) {
+ $args->{prefetch} = $prefetch;
+ # stop looking for a valid prefetch param
+ last;
+ }
+ }
+ unless (exists $args->{prefetch}) {
+ $self->push_error($c, { message => "prefetch validation failed" });
+ }
+ }
my $req_params = (grep { ref $_ } values %{$c->req->params}) ? $c->req->params : $self->expand_hash($c->req->params);
# if expand_hash didn't do anything, try json
@@ -72,7 +98,6 @@
my $source = $c->stash->{$self->rs_stash_key}->result_source;
my ($params, $join);
- my $args = {};
($params, $join) = $self->_format_search($c, { params => $req_params->{search}, source => $source }) if ($req_params->{search});
@@ -107,7 +132,7 @@
$c->log->error("setup_dbic_args_method was configured, but action $a not found");
}
}
-
+
return [$params, $args];
}
Modified: Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API.pm
===================================================================
--- Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API.pm 2009-04-16 09:32:40 UTC (rev 9711)
+++ Catalyst-Controller-DBIC-API/1.003/branches/prefetch/lib/Catalyst/Controller/DBIC/API.pm 2009-04-16 17:02:32 UTC (rev 9712)
@@ -28,8 +28,15 @@
update_allows => ['name', 'age', 'nickname'], # columns that update allows
update_allows => ['name', 'age', 'nickname'], # columns that update allows
list_returns => [qw/name age/], # columns that list returns
+ list_prefetch => ['cds'], # relationships that are prefetched when no prefetch param is passed
+ list_prefetch_allows => [ # every possible prefetch param allowed
+ 'cds',
+ qw/ cds /,
+ { cds => 'tracks' },
+ { cds => [qw/ tracks /] }
+ ],
list_ordered_by => [qw/age/], # order of generated list
- list_search_exposes => [qw/age nickname/, { cd => [qw/title year/] }], # columns that can be searched on via list
+ list_search_exposes => [qw/age nickname/, { cds => [qw/title year/] }], # columns that can be searched on via list
);
# Provides the following functional endpoints:
@@ -93,6 +100,20 @@
Arguments to pass to L<DBIx::Class::ResultSet/select> when performing search for L</list>.
+=head2 list_prefetch
+
+Arguments to pass to L<DBIx::Class::ResultSet/prefetch> when performing search for L</list>.
+
+=head2 list_prefetch_allows
+
+Arrayref listing relationships that are allowed to be prefetched.
+This is necessary to avoid denial of service attacks in form of
+queries which would return a large number of data
+and unwanted disclosure of data.
+Every element of the arrayref is one allowed parameter to prefetch.
+So for three searches, all requiring different prefetch parameters,
+three elements have to be passed to list_prefetch_allows in the controller.
+
=head2 list_grouped_by
Arguments to pass to L<DBIx::Class::ResultSet/group_by> when performing search for L</list>.
@@ -313,7 +334,7 @@
Zbigniew Lukasiak <zzbbyy at gmail.com>
- Alexander Hartmaier <alex_hartmaier at hotmail.com>
+ Alexander Hartmaier <abraxxa at cpan.org>
=head1 SPECIAL THANKS
More information about the Catalyst-commits
mailing list