From 06c746a46774b4339fec0e7f6e1fd42e8e8ccd45 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Tue, 24 Feb 2026 13:00:02 +0000 Subject: [PATCH] Bug 14962: (QA follow-up) Prevent staff_note from leaking via public API Add public_read_list to Koha::Display to exclude staff_note from the fields returned by public endpoints. The existing $c->objects->to_api mechanism automatically applies the public read list when is_public is set in the stash, which happens automatically for /public/ routes. Also add missing use C4::Context to Koha::REST::V1::Displays, which calls C4::Context->preference in the config() method. Sponsored-by: ByWater Solutions Signed-of-by: Martin Renvoize --- Koha/Display.pm | 29 +++++++++++++++++++++++++++++ Koha/REST/V1/Displays.pm | 1 + 2 files changed, 30 insertions(+) diff --git a/Koha/Display.pm b/Koha/Display.pm index 17415853ffd..231ca61774a 100644 --- a/Koha/Display.pm +++ b/Koha/Display.pm @@ -185,6 +185,35 @@ sub delete { return $result; } +=head2 Public API methods + +=head3 public_read_list + +Returns the list of fields that are allowed to be read by the public API. +Excludes staff_note which is for internal use only. + +=cut + +sub public_read_list { + return [ + qw( + display_id + display_name + start_date + end_date + enabled + display_location + display_code + display_branch + display_holding_branch + display_itype + public_note + display_days + display_return_over + ) + ]; +} + =head2 Internal methods =head3 _type diff --git a/Koha/REST/V1/Displays.pm b/Koha/REST/V1/Displays.pm index fdb1b7f0330..75aeb56b2ee 100644 --- a/Koha/REST/V1/Displays.pm +++ b/Koha/REST/V1/Displays.pm @@ -21,6 +21,7 @@ use Modern::Perl; use Mojo::Base 'Mojolicious::Controller'; +use C4::Context; use Koha::Display; use Koha::Displays; use Koha::DateUtils qw( dt_from_string ); -- 2.53.0