From 0bed0e17eeccede12a9d86a965ea8291c80b1fdb Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Tue, 17 Oct 2023 09:07:28 -0300
Subject: [PATCH] Bug 35053: Make sure request is checked as an item-level
 request if item_id passed

This patch makes the validation code have the `$item` variable defined
when checking holdability, in the case both `item_id` and `biblio_id`
params are passed.

Otherwise, if the requested item is not holdable, but a biblio-level
hold *could* be placed, the item-level hold is placed.

This is highlighted by the regression tests.

To test:
1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests don't pass. A request that should be rejected is allowed
because biblio-level hold is allowed.
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Item-level rules are checked and thus the
request rejected (code 403)
5. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
---
 Koha/REST/V1/Holds.pm | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/Koha/REST/V1/Holds.pm b/Koha/REST/V1/Holds.pm
index 543de87a32..ff162cd945 100644
--- a/Koha/REST/V1/Holds.pm
+++ b/Koha/REST/V1/Holds.pm
@@ -91,18 +91,16 @@ sub add {
 
         if ( $item_id and $biblio_id ) {
 
+            $biblio = Koha::Biblios->find($biblio_id);
+            $item   = $biblio->items->find($item_id);
+
             # check they are consistent
-            unless ( Koha::Items->search( { itemnumber => $item_id, biblionumber => $biblio_id } )
-                ->count > 0 )
-            {
+            unless ($item) {
                 return $c->render(
                     status  => 400,
                     openapi => { error => "Item $item_id doesn't belong to biblio $biblio_id" }
                 );
             }
-            else {
-                $biblio = Koha::Biblios->find($biblio_id);
-            }
         }
         elsif ($item_id) {
             $item = Koha::Items->find($item_id);
-- 
2.30.2