From bf30211007342b3b3a9652e0d5f94b664c1dfb8d Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Tue, 19 Jan 2016 11:07:48 +0000
Subject: [PATCH] Bug 14310 [QA Followup] - Use output_with_http_headers,
 return 403s

---
 svc/hold/resume  | 14 +++++++-------
 svc/hold/suspend | 14 ++++++++------
 svc/holds        |  3 +--
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/svc/hold/resume b/svc/hold/resume
index 52f3508..ca7eec2 100755
--- a/svc/hold/resume
+++ b/svc/hold/resume
@@ -23,6 +23,7 @@ use CGI;
 use JSON qw(to_json);
 
 use C4::Context;
+use C4::Output qw(output_with_http_headers);
 use C4::Auth qw(check_cookie_auth);
 use Koha::DateUtils qw(dt_from_string);
 use Koha::Holds;
@@ -30,25 +31,24 @@ use Koha::Holds;
 my $input = new CGI;
 
 my ( $auth_status, $sessionID ) =
-  check_cookie_auth( $input->cookie('CGISESSID'),
-    { circulate => 'circulate_remaining_permissions' } );
+  check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
 
 if ( $auth_status ne "ok" ) {
+    print $input->header(-type => 'text/plain', -status => '403 Forbidden');
     exit 0;
 }
 
-binmode STDOUT, ":encoding(UTF-8)";
-print $input->header( -type => 'text/json', -charset => 'UTF-8' );
-
 my $reserve_id = $input->param('reserve_id');
 
 my $hold = Koha::Holds->find( $reserve_id );
 
 unless ( $hold ) {
-    print to_json( { success => 0, error => "HOLD_NOT_FOUND" } );
+    my $json = to_json( { success => 0, error => "HOLD_NOT_FOUND" } );
+    output_with_http_headers( $input, undef, $json, "json" );
     exit;
 }
 
 $hold->resume();
 
-print to_json( { success => !$hold->suspend() } );
+my $json = to_json( { success => !$hold->suspend() } );
+output_with_http_headers( $input, undef, $json, "json" );
diff --git a/svc/hold/suspend b/svc/hold/suspend
index bd5382b..371debc 100755
--- a/svc/hold/suspend
+++ b/svc/hold/suspend
@@ -23,6 +23,7 @@ use CGI;
 use JSON qw(to_json);
 
 use C4::Context;
+use C4::Output qw(output_with_http_headers);
 use C4::Auth qw(check_cookie_auth);
 use Koha::DateUtils qw(dt_from_string);
 use Koha::Holds;
@@ -33,12 +34,10 @@ my ( $auth_status, $sessionID ) =
   check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
 
 if ( $auth_status ne "ok" ) {
+    print $input->header(-type => 'text/plain', -status => '403 Forbidden');
     exit 0;
 }
 
-binmode STDOUT, ":encoding(UTF-8)";
-print $input->header( -type => 'text/json', -charset => 'UTF-8' );
-
 my $reserve_id = $input->param('reserve_id');
 
 my $suspend_until = $input->param('suspend_until') || undef;
@@ -46,17 +45,20 @@ if ($suspend_until) {
     eval { $suspend_until = dt_from_string($suspend_until) };
 
     if ($@) {
-        print to_json( { success => 0, error => 'INVALID_DATE' } );
+        my $json = to_json( { success => 0, error => 'INVALID_DATE' } );
+        output_with_http_headers( $input, undef, $json, "json" );
         exit;
     }
 }
 
 my $hold = Koha::Holds->find($reserve_id);
 unless ($hold) {
-    print to_json( { success => 0, error => 'HOLD_NOT_FOUND' } );
+    my $json = to_json( { success => 0, error => 'HOLD_NOT_FOUND' } );
+    output_with_http_headers( $input, undef, $json, "json" );
     exit;
 }
 
 $hold->suspend_hold($suspend_until);
 
-print to_json( { success => $hold->suspend() } );
+my $json = to_json( { success => $hold->suspend() } );
+output_with_http_headers( $input, undef, $json, "json" );
diff --git a/svc/holds b/svc/holds
index 9c90f8c..6f07e42 100755
--- a/svc/holds
+++ b/svc/holds
@@ -53,8 +53,7 @@ my $borrowernumber    = $input->param('borrowernumber');
 my $offset            = $input->param('iDisplayStart');
 my $results_per_page  = $input->param('iDisplayLength');
 my $sorting_direction = $input->param('sSortDir_0') || 'desc';
-my $sorting_column    = $sort_columns[ $input->param('iSortCol_0') ]
-  || 'reservedate';
+my $sorting_column    = $input->param('iSortCol_0') ? $sort_columns[ $input->param('iSortCol_0') ] : 'reservedate';
 
 binmode STDOUT, ":encoding(UTF-8)";
 print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
-- 
2.1.4