From addee92f44c8e6adad3f9a668c89fc43904f3a37 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 13 Jan 2023 14:55:25 +0000 Subject: [PATCH] Bug 30979: Remove data from publically facing API The availability API was leaking some patron information for certain cases. This bug adds a deny-list to remove the leaked fields. --- Koha/REST/V1/Checkouts.pm | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index e0745668b3e..e66abb3e93f 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -102,7 +102,7 @@ sub get { }; } -=head3 get_availablity +=head3 get_availability Controller function that handles retrieval of Checkout availability @@ -123,6 +123,17 @@ sub get_availability { CanBookBeIssued( $patron, undef, undef, $inprocess, $ignore_reserves, $params ); + # Upgrade some confirmations to blockers if public + if ( $c->stash('is_public') ) { + my @should_block = qw/TOO_MANY ISSUED_TO_ANOTHER RESERVED RESERVED_WAITING TRANSFERRED PROCESSING AGE_RESTRICTION/; + for my $block ( @should_block ) { + if ( exists($confirmation->{$block}) ) { + $impossible->{$block} = $confirmation->{$block}; + delete $confirmation->{$block}; + } + } + } + my $token; if (keys %{$confirmation}) { my $claims = { map { $_ => 1 } keys %{$confirmation} }; @@ -131,6 +142,17 @@ sub get_availability { $token = Mojo::JWT->new( claims => $claims, secret => $secret )->encode; } + # Remove any non-public info that's returned by CanBookBeIssued + if ( $c->stash('is_public') ) { + my @restricted_keys = qw/issued_borrowernumber issued_cardnumber issued_firstname issued_surname resborrowernumber resbranchcode rescardnumber reserve_id resfirstname resreservedate ressurname item_notforloan/; + for my $key (@restricted_keys) { + delete $confirmation->{$key}; + delete $impossible->{$key}; + delete $alerts->{$key}; + delete $messages->{$key}; + } + } + my $response = { blockers => $impossible, confirms => $confirmation, -- 2.39.1