From 9bc701f6eb9a4ec5bb4944a909e0891593753ca1 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Tue, 24 Feb 2026 13:00:31 +0000 Subject: [PATCH] Bug 14962: (QA follow-up) Filter inactive display items from public API The public list_public endpoint in Koha::REST::V1::DisplayItems was returning every display_items row with no filtering. Unauthenticated OPAC users could enumerate items from disabled, expired, or future displays. Apply the same active-display criteria used elsewhere in the feature: parent display must be enabled and within its start/end date range, and the individual item's date_remove must not have passed. Sponsored-by: ByWater Solutions Signed-of-by: Martin Renvoize --- Koha/REST/V1/DisplayItems.pm | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/Koha/REST/V1/DisplayItems.pm b/Koha/REST/V1/DisplayItems.pm index f598af7174c..25374ab1f1e 100644 --- a/Koha/REST/V1/DisplayItems.pm +++ b/Koha/REST/V1/DisplayItems.pm @@ -21,6 +21,7 @@ use Modern::Perl; use Mojo::Base 'Mojolicious::Controller'; +use Koha::DateUtils qw( dt_from_string ); use Koha::DisplayItem; use Koha::DisplayItems; use Koha::Displays; @@ -157,8 +158,19 @@ sub list_public { my $c = shift->openapi->valid_input or return; return try { - my $displayitems = $c->objects->search( Koha::DisplayItems->new ); - return $c->render( status => 200, openapi => $displayitems ); + my $today = dt_from_string()->truncate( to => 'day' )->ymd; + my $displayitems = Koha::DisplayItems->search( + { + 'display.enabled' => 1, + -and => [ + -or => [ { 'display.start_date' => undef }, { 'display.start_date' => { '<=' => $today } } ], + -or => [ { 'display.end_date' => undef }, { 'display.end_date' => { '>=' => $today } } ], + ], + -or => [ { 'me.date_remove' => undef }, { 'me.date_remove' => { '>=' => $today } } ], + }, + { join => 'display' } + ); + return $c->render( status => 200, openapi => $c->objects->search($displayitems) ); } catch { $c->unhandled_exception($_); }; -- 2.53.0