From f97bfecd6b4fecb1c6e87b41af1bf21d431e0b24 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 6 Mar 2023 17:32:32 +0000 Subject: [PATCH] Bug 30979: Limit public checkout endpoint using preference The public api endpoint for self-checkout should only be enabled in the case where the OpacTrustedSelfCheckout option is enabled. Signed-off-by: Silvia Meakins Signed-off-by: Kyle M Hall --- Koha/REST/V1/Checkouts.pm | 12 ++++++++++++ api/v1/swagger/paths/public_patrons.yaml | 4 ++++ 2 files changed, 16 insertions(+) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index 0689601908..42b9f4b4b6 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -191,6 +191,18 @@ sub add { my $patron_id = $body->{patron_id}; my $onsite = $body->{onsite_checkout}; + if ( $c->stash('is_public') + && !C4::Context->preference('OpacTrustedCheckout') ) + { + return $c->render( + status => 405, + openapi => { + error => 'Feature disabled', + error_code => 'FEATURE_DISABLED' + } + ); + } + return try { my $item = Koha::Items->find($item_id); unless ($item) { diff --git a/api/v1/swagger/paths/public_patrons.yaml b/api/v1/swagger/paths/public_patrons.yaml index fb50548fd0..d5c82916ab 100644 --- a/api/v1/swagger/paths/public_patrons.yaml +++ b/api/v1/swagger/paths/public_patrons.yaml @@ -102,6 +102,10 @@ description: Cannot create checkout schema: $ref: "../swagger.yaml#/definitions/error" + "405": + description: Method not allowed + schema: + $ref: "../swagger.yaml#/definitions/error" "409": description: Conflict in creating checkout schema: -- 2.41.0