Attachment 145277 Details for Bug 30979 – Bug 30979: Remove data from publically facing API

[patch] Bug 30979: Remove data from publically facing API

Bug-30979-Remove-data-from-publically-facing-API.patch (text/plain), 1.57 KB, created by Martin Renvoize (ashimema) on 2023-01-13 14:59:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2023-01-13 14:59:01 UTC

Size: 1.57 KB

patch

obsolete

>From 77cb1ce2dcefc99419e8409dbcadac26365b63a1 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Fri, 13 Jan 2023 14:55:25 +0000
>Subject: [PATCH] Bug 30979: Remove data from publically facing API
>
>The availability API was leaking some patron information for certain
>cases.
>
>This bug adds a deny-list to remove the leaked fields.
>---
> Koha/REST/V1/Checkouts.pm | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
>diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm
>index e0745668b3e..658e6361bf9 100644
>--- a/Koha/REST/V1/Checkouts.pm
>+++ b/Koha/REST/V1/Checkouts.pm
>@@ -102,7 +102,7 @@ sub get {
>     };
> }
> 
>-=head3 get_availablity
>+=head3 get_availability
> 
> Controller function that handles retrieval of Checkout availability
> 
>@@ -131,6 +131,17 @@ sub get_availability {
>         $token = Mojo::JWT->new( claims => $claims, secret => $secret )->encode;
>     }
> 
>+    # Remove any non-public info that's returned by CanBookBeIssued
>+    if ( $c->stash('is_public') ) {
>+        my @restricted_keys = qw/issued_borrowernumber issued_cardnumber issued_firstname issued_surname resborrowernumber resbranchcode rescardnumber reserve_id resfirstname resreservedate ressurname item_notforloan/;
>+        for my $key (@restricted_keys) {
>+            delete $confirmation->{$key};
>+            delete $impossible->{$key};
>+            delete $alerts->{$key};
>+            delete $messages->{$key};
>+        }
>+    }
>+
>     my $response = {
>         blockers           => $impossible,
>         confirms           => $confirmation,
>-- 
>2.39.0

Actions: View | Diff | Splinter Review

Attachments on bug 30979: 139131 | 139132 | 139133 | 139134 | 141274 | 141275 | 141276 | 141277 | 141278 | 141279 | 141300 | 145264 | 145265 | 145266 | 145267 | 145268 | 145277 | 145280 | 145281 | 145282 | 145283 | 145284 | 145285 | 145620 | 145621 | 145622 | 145623 | 145624 | 145625 | 145626 | 145627 | 145628 | 145629 | 145630 | 150867 | 150868 | 150869 | 150870 | 150871 | 150872 | 150873 | 150874 | 150875 | 150876 | 150877 | 150878 | 150879 | 150880 | 150881 | 150882 | 150883 | 150884 | 150885 | 150886 | 150887 | 150888 | 150889 | 150967 | 150968 | 150969 | 150970 | 150971 | 150972 | 150973 | 150974 | 151254 | 151255 | 151256 | 151257 | 151258 | 151259 | 151260 | 151261 | 151358 | 151359 | 151360 | 151361 | 151362 | 151363 | 151364 | 151365 | 151368 | 151369 | 151370 | 151371 | 151372 | 151373 | 151374 | 151375 | 151376 | 152789 | 152790 | 152791 | 152792 | 152793 | 152794 | 152795 | 152796 | 152797 | 153459 | 153460 | 153461 | 153462 | 153463 | 153464 | 153465 | 153466 | 153467 | 153500 | 153501 | 153502 | 153503