From c1b75dd4461eefe848f68edc3b4f81c86751c47f Mon Sep 17 00:00:00 2001 From: Jiri Kozlovsky Date: Mon, 1 Aug 2016 15:36:05 +0200 Subject: [PATCH] Bug 16825: (followup) Add API route for getting an item Added on top of last patch the OpacHiddenItems syspref restriction for users who are not staff. They see "Item Not Found" when trying to view item hidden from OPAC. Only staff can see those GET /api/v1/items/{itemnumber} Gets one Item This patch adds route to get one item from koha.items table. This table has a column "itemnotes_nonpublic", which should not be returned if the user has no catalogue permission. To test: 1. Open a browser tab on Koha staff and log in (to create CGISESSID cookie). 2. Send GET request to http://yourlibrary/api/v1/items/YYY where YYY is an existing itemnumber. 3. Make sure the returned data is correct. 4. Run unit tests in t/db_dependent/api/v1/items.t Signed-off-by: Jiri Kozlovsky Signed-off-by: Benjamin Rokseth --- Koha/REST/V1/Item.pm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Koha/REST/V1/Item.pm b/Koha/REST/V1/Item.pm index 03fd333..a5595bd 100644 --- a/Koha/REST/V1/Item.pm +++ b/Koha/REST/V1/Item.pm @@ -21,6 +21,7 @@ use Mojo::Base 'Mojolicious::Controller'; use Mojo::JSON; use C4::Auth qw( haspermission ); +use C4::Items qw( GetHiddenItemnumbers ); use Koha::Items; @@ -36,6 +37,14 @@ sub get { # Hide non-public itemnotes if user has no staff access my $user = $c->stash('koha.user'); unless ($user && haspermission($user->userid, {catalogue => 1})) { + + my @hiddenitems = C4::Items::GetHiddenItemnumbers( ({ itemnumber => $itemnumber}) ); + my %hiddenitems = map { $_ => 1 } @hiddenitems; + + # Pretend it was not found as it's hidden from OPAC to regular users + return $c->$cb({error => "Item not found"}, 404) + if $hiddenitems{$itemnumber}; + $item->set({ itemnotes_nonpublic => undef }); } -- 2.1.4