From a8211f9fa163d6b72ba19248f94a65f98c80f51b Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 17 Nov 2021 18:03:00 -0300
Subject: [PATCH] Bug 29510: Make objects.find call search_limited if present

This patch makes objects.find implicitly update the passed
*$result_set* to use search_limited. This way no object leaks could
happen without noticing.

To test:
1. Apply the regression tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t
=> FAIL: Tests fail because search_limited is not used
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Results are correctly filtered based on userenv!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha/REST/Plugin/Objects.pm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm
index 4a5d29143c..cde3d8fe7a 100644
--- a/Koha/REST/Plugin/Objects.pm
+++ b/Koha/REST/Plugin/Objects.pm
@@ -62,6 +62,9 @@ the requested object. It passes through any embeds if specified.
                 }
             );
 
+            $result_set = $result_set->search_limited
+                if $result_set->can('search_limited');
+
             my $object = $result_set->find( $id, $attributes );
 
             return unless $object;
-- 
2.39.5