From 832d1d1bacb491beb3910afd49c5273af35f6f32 Mon Sep 17 00:00:00 2001
From: Jan Kissig <jkissig@th-wildau.de>
Date: Fri, 3 May 2024 14:11:58 +0200
Subject: [PATCH] Bug 36772: OPAC Self checkout accepts wrong or partial
 barcodes

    When using the opac trusted checkout feature it is possible to enter non existant or partial barcodes to check out items.

    Testplan:
    a) set  System preference OpacTrustedCheckout  to Allow
    b) go to http://localhost:8080/ and login with koha / koha
    c) click Self Checkout in navigation bar
    d) enter barcode 1234
    e) result: Item '39999000011234' was checked out

    apply patch and reload the page

    a) now enter barcode 1234
    b) result: Item '1234' not found
    c) enter 39999000011234
    d) result: Item '39999000011234' was checked out

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 koha-tmpl/opac-tmpl/bootstrap/js/modals/checkout.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/js/modals/checkout.js b/koha-tmpl/opac-tmpl/bootstrap/js/modals/checkout.js
index e1bfe78b2ba..9495d02ee4c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/js/modals/checkout.js
+++ b/koha-tmpl/opac-tmpl/bootstrap/js/modals/checkout.js
@@ -118,7 +118,7 @@ $(document).ready(function() {
 
         let item_id;
         let items = $.ajax({
-            url: "/api/v1/public/items?external_id=" + external_id,
+            url: "/api/v1/public/items?_match=exact&external_id=" + external_id,
             headers: {
                 "x-koha-embed": "biblio",
             },
-- 
2.45.0