From 242abeeedf26ce6d1226878a7ee8d9664d4d2749 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Tue, 12 Sep 2023 10:25:36 +0100 Subject: [PATCH] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. --- Koha/REST/V1/Checkouts.pm | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index e94d027e49..d8f0827d6f 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -156,6 +156,12 @@ sub get_availability { my $user = $c->stash('koha.user'); my $patron = Koha::Patrons->find( $c->param('patron_id') ); + + if ( $c->stash('is_public') && ( $user->id ne $patron->id ) ) { + my $error = { error => 'Unauthorized', error_code => 'UNAUTHORIZED' }; + return $c->render( status => 403, openapi => $error ); + } + my $item = Koha::Items->find( $c->param('item_id') ); my ( $impossible, $confirmation, $warnings ) = -- 2.41.0