Skip to content

fix(#633): handle invalid UUIDs in not_found_by parameter #636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stefopl wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix(#633): handle invalid UUIDs in not_found_by parameter #636

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc73c1f
fix(#633): handle invalid UUIDs in not_found_by parameter
Oct 2, 2025
8452079
refactor: extract duplicate found_by and not_found_by filter logic in…
stefopl May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 45 additions & 53 deletions okapi/services/caches/search/SearchAssistant.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,64 +418,13 @@ public function prepare_common_search_params()
# found_by
#

if ($tmp = $this->request->get_parameter('found_by'))
{
try {
$users = OkapiServiceRunner::call("services/users/users", new OkapiInternalRequest(
$this->request->consumer, null, array('user_uuids' => $tmp, 'fields' => 'internal_id')));
} catch (InvalidParam $e) { # too many uuids
throw new InvalidParam('found_by', $e->whats_wrong_about_it);
}

if (empty($users) || !is_array($users)) {
throw new InvalidParam('found_by', "No valid users found for the given parameter.");
}

$user_uuids = explode("|", $tmp);

$invalid_uuids = [];
foreach ($user_uuids as $uuid) {
if (!isset($users[$uuid])) {
$invalid_uuids[] = $uuid;
}
}

if (!empty($invalid_uuids)) {
throw new InvalidParam('found_by', "The following UUID(s) are invalid or not found: " . implode(", ", $invalid_uuids));
}

$internal_user_ids = array_map(function ($user) { return $user["internal_id"]; }, $users);
if (Settings::get('USE_SQL_SUBQUERIES')) {
$found_cache_subquery = self::get_found_cache_ids_subquery($internal_user_ids);
$where_conds[] = "caches.cache_id in (".$found_cache_subquery.")";
} else {
$found_cache_ids = self::get_found_cache_ids($internal_user_ids);
$where_conds[] = "caches.cache_id in ('".implode("','", array_map('\okapi\core\Db::escape_string', $found_cache_ids))."')";
}
}
$this->apply_found_by_filter($where_conds);

#
# not_found_by
#

if ($tmp = $this->request->get_parameter('not_found_by'))
{
try {
$users = OkapiServiceRunner::call("services/users/users", new OkapiInternalRequest(
$this->request->consumer, null, array('user_uuids' => $tmp, 'fields' => 'internal_id')));
} catch (InvalidParam $e) { # too many uuids
throw new InvalidParam('not_found_by', $e->whats_wrong_about_it);
}

$internal_user_ids = array_map(function ($user) { return $user["internal_id"]; }, $users);
if (Settings::get('USE_SQL_SUBQUERIES')) {
$found_cache_subquery = self::get_found_cache_ids_subquery($internal_user_ids);
$where_conds[] = "caches.cache_id not in (".$found_cache_subquery.")";
} else {
$found_cache_ids = self::get_found_cache_ids($internal_user_ids);
$where_conds[] = "caches.cache_id not in ('".implode("','", array_map('\okapi\core\Db::escape_string', $found_cache_ids))."')";
}
}
$this->apply_found_by_filter($where_conds, true);

#
# recommended_only
Expand Down Expand Up @@ -815,6 +764,49 @@ public function prepare_common_search_params()
}
}

private function apply_found_by_filter(&$where_conds, $is_exclude = false)
{
$param_name = $is_exclude ? 'not_found_by' : 'found_by';

if ($tmp = $this->request->get_parameter($param_name))
{
try {
$users = OkapiServiceRunner::call("services/users/users", new OkapiInternalRequest(
$this->request->consumer, null, array('user_uuids' => $tmp, 'fields' => 'internal_id')));
} catch (InvalidParam $e) { # too many uuids
throw new InvalidParam($param_name, $e->whats_wrong_about_it);
}

if (empty($users) || !is_array($users)) {
throw new InvalidParam($param_name, "No valid users found for the given parameter.");
}

$user_uuids = explode("|", $tmp);

$invalid_uuids = [];
foreach ($user_uuids as $uuid) {
if (!isset($users[$uuid])) {
$invalid_uuids[] = $uuid;
}
}

if (!empty($invalid_uuids)) {
throw new InvalidParam($param_name, "The following UUID(s) are invalid or not found: " . implode(", ", $invalid_uuids));
}

$internal_user_ids = array_map(function ($user) { return $user["internal_id"]; }, $users);
$operator = $is_exclude ? "not in" : "in";

if (Settings::get('USE_SQL_SUBQUERIES')) {
$found_cache_subquery = self::get_found_cache_ids_subquery($internal_user_ids);
$where_conds[] = "caches.cache_id $operator (".$found_cache_subquery.")";
} else {
$found_cache_ids = self::get_found_cache_ids($internal_user_ids);
$where_conds[] = "caches.cache_id $operator ('".implode("','", array_map('\okapi\core\Db::escape_string', $found_cache_ids))."')";
}
}
}

/**
* Search for caches using conditions and options stored in the instance
* of this class. These conditions are usually initialized by the call
Expand Down