honeymoose
/
hapi-fhir
mirror of https://github.com/hapifhir/hapi-fhir.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

clean up

This commit is contained in:
Jason Roberts 2021-09-23 12:27:32 -04:00
parent 9e8164d73a
commit 712a6a798f
2 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/5_6_0/3018-search-narrowing-interceptor-forbidden-scope.yaml
View File

@ -2,7 +2,7 @@
type: add
issue: 3018
jira: SMILE-782
title: "Previously, when a search query explicitly included a search parameter that was for the same resource type but a
different resource instance from the one specified in the token, the search narrowing interceptor would include both search
parameters in the final query, resulting in an empty bundle being returned to the caller. Now, such a call will result in
a 403 Forbidden error, making it more clear why no resources were returned."
title: "Previously, when a search query explicitly includes a search parameter that is for the same resource type but a
different resource instance from the one(s) specified on the authorized list, the search narrowing interceptor would include
both search parameters in the final query, resulting in an empty bundle being returned to the caller. Now, such a call
will result in a 403 Forbidden error, making it more clear why no resources were returned."

9
hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptor.java
View File

@ -285,21 +285,20 @@ public class SearchNarrowingInterceptor {
searchParamName = primarySearchParamName;
} else {
// If the primary search parameter itself isn't in use, check to see whether any of its synonyms are.
List<RuntimeSearchParam> synonyms = findSynonyms(searchParams, primarySearchParam.get());
Optional<RuntimeSearchParam> synonymInUse = synonyms
Optional<RuntimeSearchParam> synonymInUse = findSynonyms(searchParams, primarySearchParam.get())
.stream()
.filter(t -> queryParameters.contains(t.getName()))
.findFirst();
if (synonymInUse.isPresent()) {
// if so, use one of those
// if a synonym is in use, use it
searchParamName = synonymInUse.get().getName();
} else {
// if not, i.e., the original query is not filtering on this field at all, use the primary
// if not, i.e., the original query is not filtering on this field at all, use the primary search param
searchParamName = primarySearchParamName;
}
}
} else {
// Otherwise, fall back to whatever is available
// Otherwise, fall back to whatever search parameter is available
searchParamName = searchParams.get(0).getName();
}