Bugzilla – Attachment 193742 Details for
Bug 14962
Temp Shelving Location / On Display Module
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14962: (QA follow-up) Prevent staff_note from leaking via public API
06c746a.patch (text/plain), 2.05 KB, created by
Martin Renvoize (ashimema)
on 2026-02-24 13:36:55 UTC
(
hide
)
Description:
Bug 14962: (QA follow-up) Prevent staff_note from leaking via public API
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2026-02-24 13:36:55 UTC
Size:
2.05 KB
patch
obsolete
>From 06c746a46774b4339fec0e7f6e1fd42e8e8ccd45 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@openfifth.co.uk> >Date: Tue, 24 Feb 2026 13:00:02 +0000 >Subject: [PATCH] Bug 14962: (QA follow-up) Prevent staff_note from leaking via > public API > >Add public_read_list to Koha::Display to exclude staff_note from the >fields returned by public endpoints. The existing $c->objects->to_api >mechanism automatically applies the public read list when is_public is >set in the stash, which happens automatically for /public/ routes. > >Also add missing use C4::Context to Koha::REST::V1::Displays, which >calls C4::Context->preference in the config() method. > >Sponsored-by: ByWater Solutions >Signed-of-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> >--- > Koha/Display.pm | 29 +++++++++++++++++++++++++++++ > Koha/REST/V1/Displays.pm | 1 + > 2 files changed, 30 insertions(+) > >diff --git a/Koha/Display.pm b/Koha/Display.pm >index 17415853ffd..231ca61774a 100644 >--- a/Koha/Display.pm >+++ b/Koha/Display.pm >@@ -185,6 +185,35 @@ sub delete { > return $result; > } > >+=head2 Public API methods >+ >+=head3 public_read_list >+ >+Returns the list of fields that are allowed to be read by the public API. >+Excludes staff_note which is for internal use only. >+ >+=cut >+ >+sub public_read_list { >+ return [ >+ qw( >+ display_id >+ display_name >+ start_date >+ end_date >+ enabled >+ display_location >+ display_code >+ display_branch >+ display_holding_branch >+ display_itype >+ public_note >+ display_days >+ display_return_over >+ ) >+ ]; >+} >+ > =head2 Internal methods > > =head3 _type >diff --git a/Koha/REST/V1/Displays.pm b/Koha/REST/V1/Displays.pm >index fdb1b7f0330..75aeb56b2ee 100644 >--- a/Koha/REST/V1/Displays.pm >+++ b/Koha/REST/V1/Displays.pm >@@ -21,6 +21,7 @@ use Modern::Perl; > > use Mojo::Base 'Mojolicious::Controller'; > >+use C4::Context; > use Koha::Display; > use Koha::Displays; > use Koha::DateUtils qw( dt_from_string ); >-- >2.53.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14962
:
190216
|
190217
|
190218
|
190219
|
190220
|
190221
|
190222
|
190223
|
190224
|
190225
|
190226
|
190227
|
190228
|
190229
|
190230
|
190231
|
190232
|
190571
|
190572
|
193719
|
193720
|
193721
|
193722
|
193723
|
193724
|
193725
|
193726
|
193727
|
193728
|
193729
|
193730
|
193731
|
193732
|
193733
|
193734
|
193735
|
193736
|
193737
|
193738
|
193739
|
193740
|
193741
|
193742
|
193743
|
193744
|
193745
|
193746
|
193747
|
193748
|
193749
|
193750
|
193751
|
193752
|
193753
|
193754
|
193755
|
194285
|
194286
|
194287
|
194288
|
194289
|
194290
|
194291
|
194292
|
194293
|
194294
|
194295
|
194296
|
194297
|
194298
|
194299
|
194300
|
194301
|
194302
|
194303
|
194304
|
194305
|
194306
|
194307
|
194308
|
194309
|
194310
|
194311
|
194312
|
194313
|
194314
|
194315
|
194316
|
194317
|
194318
|
194320
|
194321
|
194322