From 77cb1ce2dcefc99419e8409dbcadac26365b63a1 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 13 Jan 2023 14:55:25 +0000 Subject: [PATCH] Bug 30979: Remove data from publically facing API The availability API was leaking some patron information for certain cases. This bug adds a deny-list to remove the leaked fields. --- Koha/REST/V1/Checkouts.pm | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index e0745668b3e..658e6361bf9 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -102,7 +102,7 @@ sub get { }; } -=head3 get_availablity +=head3 get_availability Controller function that handles retrieval of Checkout availability @@ -131,6 +131,17 @@ sub get_availability { $token = Mojo::JWT->new( claims => $claims, secret => $secret )->encode; } + # Remove any non-public info that's returned by CanBookBeIssued + if ( $c->stash('is_public') ) { + my @restricted_keys = qw/issued_borrowernumber issued_cardnumber issued_firstname issued_surname resborrowernumber resbranchcode rescardnumber reserve_id resfirstname resreservedate ressurname item_notforloan/; + for my $key (@restricted_keys) { + delete $confirmation->{$key}; + delete $impossible->{$key}; + delete $alerts->{$key}; + delete $messages->{$key}; + } + } + my $response = { blockers => $impossible, confirms => $confirmation, -- 2.39.0