diff --git a/application/applicationextension.inc.php b/application/applicationextension.inc.php index 0233d78d9..b40bf1e94 100644 --- a/application/applicationextension.inc.php +++ b/application/applicationextension.inc.php @@ -1979,7 +1979,7 @@ class RestUtils $aFieldList[$sClass][] = $sAttCode; } else { if ($bFailIfNotFound) { - throw new Exception("$sParamName: Unknown attribute '$sAttCode' for class '$sClass'"); + throw new Exception("$sParamName: invalid attribute code '$sAttCode' for class '$sClass'"); } } } diff --git a/core/restservices.class.inc.php b/core/restservices.class.inc.php index a90297325..ba9309274 100644 --- a/core/restservices.class.inc.php +++ b/core/restservices.class.inc.php @@ -571,13 +571,21 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer break; case 'core/get': - $sClass = RestUtils::GetClass($aParams, 'class'); + $sClassParam = RestUtils::GetMandatoryParam($aParams, 'class'); $key = RestUtils::GetMandatoryParam($aParams, 'key'); $sShowFields = RestUtils::GetOptionalParam($aParams, 'output_fields', '*'); $iLimit = (int)RestUtils::GetOptionalParam($aParams, 'limit', 0); $iPage = (int)RestUtils::GetOptionalParam($aParams, 'page', 1); - $oObjectSet = RestUtils::GetObjectSetFromKey($sClass, $key, $iLimit, self::getOffsetFromLimitAndPage($iLimit, $iPage)); + // Validate the class(es) + $aClass = explode(',', $sClassParam); + foreach ($aClass as $sClass) { + if (!MetaModel::IsValidClass(trim($sClass))) { + throw new Exception("class '$sClass' is not valid"); + } + } + + $oObjectSet = RestUtils::GetObjectSetFromKey($sClassParam, $key, $iLimit, self::getOffsetFromLimitAndPage($iLimit, $iPage)); $sTargetClass = $oObjectSet->GetFilter()->GetClass(); if (UserRights::IsActionAllowed($sTargetClass, UR_ACTION_READ) != UR_ALLOWED_YES) @@ -601,7 +609,7 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer $aCache = []; $aShowFields = []; foreach ($oObjectSet->GetSelectedClasses() as $sSelectedClass) { - $aShowFields = array_merge( $aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields')); + $aShowFields = array_merge( $aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields', false)); } while ($oObjects = $oObjectSet->FetchAssoc()) { @@ -639,9 +647,13 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer } $oResult->message = "Found: ".$oObjectSet->Count(); } else { - $aShowFields = RestUtils::GetFieldList($sClass, $aParams, 'output_fields'); + $aShowFields =[]; + foreach ($aClass as $sSelectedClass) { + $sSelectedClass = trim($sSelectedClass); + $aShowFields = array_merge($aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields', false)); + } - if (!RestUtils::HasRequestedAllOutputFields($sShowFields)) { + if (!RestUtils::HasRequestedAllOutputFields($sShowFields) && count($aShowFields) == 1) { $aFields = $aShowFields[$sClass]; //Id is not a valid attribute to optimize if (in_array('id', $aFields)) {