From 4bb7dbebb731b819107f4ab67b9df2d2c8802df6 Mon Sep 17 00:00:00 2001 From: Pedro Amorim Date: Mon, 20 Oct 2025 15:33:04 +0000 Subject: [PATCH] Bug 41057: Return 404 if creating backend is not an OPAC backend Test plan, ktd: 1) Enable ILLModule 2) Install an additional backend plugin e.g. 'RapidILL': https://github.com/openfifth/koha-ill-rapidill/releases/tag/v2.2.5 3) Restart plack if you have to: $ koha-plack --restart kohadev 4) Edit the ILLOpacbackends system preference to just 'Standard'. 5) Now, attempt to create a request with the installed backend directly: /cgi-bin/koha/opac-illrequests.pl?op=add_form&backend=RapidILL 6) Notice the form is shown. It shouldn't be, as the only OPAC back is Standard. 7) Apply patch. Repeat. You get a 404. Signed-off-by: Nial Halford-Busby --- opac/opac-illrequests.pl | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/opac/opac-illrequests.pl b/opac/opac-illrequests.pl index b089c29d6f2..17737e49001 100755 --- a/opac/opac-illrequests.pl +++ b/opac/opac-illrequests.pl @@ -72,8 +72,14 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( ); # Are we able to actually work? -my $patron = Koha::Patrons->find($loggedinuser); -my $backends = Koha::ILL::Request::Config->new->opac_available_backends($patron); +my $patron = Koha::Patrons->find($loggedinuser); +my $backends = Koha::ILL::Request::Config->new->opac_available_backends($patron); + +if ( $params->{backend} && !grep { $_ eq $params->{backend} } @$backends ) { + print $query->redirect("/cgi-bin/koha/errors/404.pl"); + exit; +} + my $backends_available = ( scalar @{$backends} > 0 ); $template->param( backends_available => $backends_available ); -- 2.39.5