Bugzilla – Attachment 194309 Details for
Bug 14962
Temp Shelving Location / On Display Module
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14962: (QA follow-up) Filter inactive display items from public API
38323a2.patch (text/plain), 2.26 KB, created by
Martin Renvoize (ashimema)
on 2026-03-02 10:24:34 UTC
(
hide
)
Description:
Bug 14962: (QA follow-up) Filter inactive display items from public API
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2026-03-02 10:24:34 UTC
Size:
2.26 KB
patch
obsolete
>From 38323a2e5199c4ea72a3c8a1486962a528ba5cea Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@openfifth.co.uk> >Date: Tue, 24 Feb 2026 13:00:31 +0000 >Subject: [PATCH] Bug 14962: (QA follow-up) Filter inactive display items from > public API > >The public list_public endpoint in Koha::REST::V1::DisplayItems was >returning every display_items row with no filtering. Unauthenticated >OPAC users could enumerate items from disabled, expired, or future >displays. > >Apply the same active-display criteria used elsewhere in the feature: >parent display must be enabled and within its start/end date range, and >the individual item's date_remove must not have passed. > >Sponsored-by: ByWater Solutions >Signed-of-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> >--- > Koha/REST/V1/DisplayItems.pm | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > >diff --git a/Koha/REST/V1/DisplayItems.pm b/Koha/REST/V1/DisplayItems.pm >index f598af7174c..25374ab1f1e 100644 >--- a/Koha/REST/V1/DisplayItems.pm >+++ b/Koha/REST/V1/DisplayItems.pm >@@ -21,6 +21,7 @@ use Modern::Perl; > > use Mojo::Base 'Mojolicious::Controller'; > >+use Koha::DateUtils qw( dt_from_string ); > use Koha::DisplayItem; > use Koha::DisplayItems; > use Koha::Displays; >@@ -157,8 +158,19 @@ sub list_public { > my $c = shift->openapi->valid_input or return; > > return try { >- my $displayitems = $c->objects->search( Koha::DisplayItems->new ); >- return $c->render( status => 200, openapi => $displayitems ); >+ my $today = dt_from_string()->truncate( to => 'day' )->ymd; >+ my $displayitems = Koha::DisplayItems->search( >+ { >+ 'display.enabled' => 1, >+ -and => [ >+ -or => [ { 'display.start_date' => undef }, { 'display.start_date' => { '<=' => $today } } ], >+ -or => [ { 'display.end_date' => undef }, { 'display.end_date' => { '>=' => $today } } ], >+ ], >+ -or => [ { 'me.date_remove' => undef }, { 'me.date_remove' => { '>=' => $today } } ], >+ }, >+ { join => 'display' } >+ ); >+ return $c->render( status => 200, openapi => $c->objects->search($displayitems) ); > } catch { > $c->unhandled_exception($_); > }; >-- >2.53.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14962
:
190216
|
190217
|
190218
|
190219
|
190220
|
190221
|
190222
|
190223
|
190224
|
190225
|
190226
|
190227
|
190228
|
190229
|
190230
|
190231
|
190232
|
190571
|
190572
|
193719
|
193720
|
193721
|
193722
|
193723
|
193724
|
193725
|
193726
|
193727
|
193728
|
193729
|
193730
|
193731
|
193732
|
193733
|
193734
|
193735
|
193736
|
193737
|
193738
|
193739
|
193740
|
193741
|
193742
|
193743
|
193744
|
193745
|
193746
|
193747
|
193748
|
193749
|
193750
|
193751
|
193752
|
193753
|
193754
|
193755
|
194285
|
194286
|
194287
|
194288
|
194289
|
194290
|
194291
|
194292
|
194293
|
194294
|
194295
|
194296
|
194297
|
194298
|
194299
|
194300
|
194301
|
194302
|
194303
|
194304
|
194305
|
194306
|
194307
|
194308
| 194309 |
194310
|
194311
|
194312
|
194313
|
194314
|
194315
|
194316
|
194317
|
194318
|
194320
|
194321
|
194322