From 595e45d20da91ed6d5d87e7892cbf4fc089a2058 Mon Sep 17 00:00:00 2001 From: Jiri Kozlovsky Date: Mon, 1 Aug 2016 15:36:05 +0200 Subject: [PATCH] Bug 16825: (followup) Add API route for getting an item Added on top of last patch the OpacHiddenItems syspref restriction for users who are not staff. They see "Item Not Found" when trying to view item hidden from OPAC. Only staff can see those GET /api/v1/items/{itemnumber} Gets one Item This patch adds route to get one item from koha.items table. This table has a column "itemnotes_nonpublic", which should not be returned if the user has no catalogue permission. To test: 1. Open a browser tab on Koha staff and log in (to create CGISESSID cookie). 2. Send GET request to http://yourlibrary/api/v1/items/YYY where YYY is an existing itemnumber. 3. Make sure the returned data is correct. 4. Run unit tests in t/db_dependent/api/v1/items.t Signed-off-by: Jiri Kozlovsky Signed-off-by: Benjamin Rokseth Signed-off-by: Lari Taskula --- Koha/REST/V1/Item.pm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Koha/REST/V1/Item.pm b/Koha/REST/V1/Item.pm index 03fd333..e300ecb 100644 --- a/Koha/REST/V1/Item.pm +++ b/Koha/REST/V1/Item.pm @@ -21,6 +21,7 @@ use Mojo::Base 'Mojolicious::Controller'; use Mojo::JSON; use C4::Auth qw( haspermission ); +use C4::Items qw( GetHiddenItemnumbers ); use Koha::Items; @@ -36,6 +37,14 @@ sub get { # Hide non-public itemnotes if user has no staff access my $user = $c->stash('koha.user'); unless ($user && haspermission($user->userid, {catalogue => 1})) { + + my @hiddenitems = C4::Items::GetHiddenItemnumbers( ({ itemnumber => $itemnumber}) ); + my %hiddenitems = map { $_ => 1 } @hiddenitems; + + # Pretend it was not found as it's hidden from OPAC to regular users + return $c->$cb({error => "Item not found"}, 404) + if $hiddenitems{$itemnumber}; + $item->set({ itemnotes_nonpublic => undef }); } -- 1.9.1