From 242abeeedf26ce6d1226878a7ee8d9664d4d2749 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Tue, 12 Sep 2023 10:25:36 +0100
Subject: [PATCH] Bug 34287: Add check on public availability endpoint

A quick check for patron equals current user in the public availability
endpoint.
---
 Koha/REST/V1/Checkouts.pm | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm
index e94d027e49..d8f0827d6f 100644
--- a/Koha/REST/V1/Checkouts.pm
+++ b/Koha/REST/V1/Checkouts.pm
@@ -156,6 +156,12 @@ sub get_availability {
     my $user = $c->stash('koha.user');
 
     my $patron = Koha::Patrons->find( $c->param('patron_id') );
+
+    if ( $c->stash('is_public') && ( $user->id ne $patron->id ) ) {
+        my $error = { error => 'Unauthorized', error_code => 'UNAUTHORIZED' };
+        return $c->render( status => 403, openapi => $error );
+    }
+
     my $item   = Koha::Items->find( $c->param('item_id') );
 
     my ( $impossible, $confirmation, $warnings ) =
-- 
2.41.0