From 65d1e8da393e29d5482149683cc53f0a45d383c6 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Tue, 24 Feb 2026 13:01:33 +0000 Subject: [PATCH] Bug 14962: (QA follow-up) Apply full active-display filter in get_public get_public only checked end_date, allowing disabled displays and displays not yet started to be retrieved by unauthenticated OPAC users. Apply the same criteria used by Koha::Displays->active: enabled must be true, start_date must be null or in the past, and end_date must be null or in the future. Sponsored-by: ByWater Solutions Signed-of-by: Martin Renvoize --- Koha/REST/V1/Displays.pm | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/Koha/REST/V1/Displays.pm b/Koha/REST/V1/Displays.pm index 75aeb56b2ee..8a752dc2bc4 100644 --- a/Koha/REST/V1/Displays.pm +++ b/Koha/REST/V1/Displays.pm @@ -233,17 +233,22 @@ sub get_public { my $c = shift->openapi->valid_input or return; return try { - my $display = Koha::Displays->find( $c->param('display_id') ); + my $today = dt_from_string->truncate( to => 'day' )->ymd; + + my $display = Koha::Displays->search( + { + display_id => $c->param('display_id'), + enabled => 1, + -and => [ + -or => [ { start_date => undef }, { start_date => { '<=' => $today } } ], + -or => [ { end_date => undef }, { end_date => { '>=' => $today } } ], + ], + } + )->next; return $c->render_resource_not_found("Display") unless $display; - my $today = dt_from_string->truncate( to => 'day' )->ymd; - - if ( $display->end_date && $display->end_date < $today ) { - return $c->render_resource_not_found("Display"); - } - return $c->render( status => 200, openapi => $c->objects->to_api($display), ); } catch { $c->unhandled_exception($_); -- 2.53.0