-
Notifications
You must be signed in to change notification settings - Fork 189
Description
Describe the bug
Instrument class validate() method should validate data against the instrument definition, but ends up only doing the same as determineDataEntryAllowed() method (alias).
Loris/php/libraries/NDB_BVL_Instrument.class.inc
Lines 3130 to 3133 in 0883fde
| function validate(array $values): bool | |
| { | |
| return $this->determineDataEntryAllowed(); | |
| } |
This is confusing in the code, as this is making the API instrument endpoints checks not validating data even if the code seems pretty explicit about it. The process is:
- check if data entry is allowed = instrument not in complete state.
- get the data from the request payload.
- check if the data is valid for that instrument.
Step 3. should data validated against the instrument, but ends up only doing the same as step 1.
Loris/modules/api/php/endpoints/candidate/visit/instrument/instrument.class.inc
Lines 171 to 191 in 0883fde
| */ | |
| private function _handlePUT(ServerRequestInterface $request) : ResponseInterface | |
| { | |
| if (!$this->_instrument->determineDataEntryAllowed()) { | |
| return new \LORIS\Http\Response\JSON\Forbidden( | |
| 'Can not update instruments that are flagged as complete.' | |
| ); | |
| } | |
| $data = json_decode((string) $request->getBody(), true); | |
| if (!is_array($data)) { | |
| return new \LORIS\Http\Response\JSON\BadRequest( | |
| 'Invalid request' | |
| ); | |
| } | |
| if (!$this->_instrument->validate($data)) { | |
| return new \LORIS\Http\Response\JSON\Forbidden( | |
| 'Could not update.' | |
| ); | |
| } |
This makes that the instrument API endpoint is accepting any data.
To Reproduce
Steps to reproduce the behavior (attach screenshots if applicable):
- Get an instrument with different types of fields (get the commentID/candidate/visit label/instrument).
- Go to
api_docs:Tools > API documentation. - Get the instrument data with the GET endpoint
/candidates/{candid}/{visit}/instruments/{instrument}. - Copy paste it to the PUT endpoint
/candidates/{candid}/{visit}/instruments/{instrument}. - Change some values, also changing select/multiselect (dropdown) to options that do not even exist in the option list of these fields.
- send the request, see the 200 ok code.
- Check the corresponding data from the db.
What did you expect to happen?
An error code returned if the validation of data fails.