Bug 40920

Summary: Checkout endpoint crashes with parameter "patron_id"
Product: Koha Reporter: Arthur Suzuki <arthur.suzuki>
Component: REST APIAssignee: Bugs List <koha-bugs>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: tomascohen
Version: 24.11   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 40920: fix invalid patron_id parameter

Description Arthur Suzuki 2025-10-01 07:18:13 UTC
A call to /api/v1/checkouts?patron_id=51 crashes Koha.

We get this in the logs:
Unknown column 'patron_id' in 'WHERE' at /home/koha/src/Koha/REST/Plugin/Objects.pm

I tried to replace patron_id parameter with "borrowernumber" in the request but it crashes as well as borrowernumber is not a valid input.
This is a regression from 23.11 we experienced in 24.11 and main.
I've made a small patch to solve this but there is probably a better way to do it.
Comment 1 Arthur Suzuki 2025-10-01 07:28:47 UTC
Created attachment 187160 [details] [review]
Bug 40920: fix invalid patron_id parameter

Test plan:
- on KTD, without patch, create an issue for user "koha" (patron_id 51)
- go to http://localhost:8081/api/v1/checkouts?patron_id=51
- you should get an error (and no issues)
- in /var/log/koha/plack-api-error.log you will see "Unknown column 'patron_id'".
- apply patch and "restart_all"
- make the same request to the api
- you should see the issue for user koha.
Comment 2 Arthur Suzuki 2025-10-01 07:48:17 UTC
to be more specific, the failing request is the following :
http://localhost:8081//api/v1/checkouts?q={%22item_id%22:{%22-not_like%22:%22null%22}}&_match=exact&_page=1&_per_page=20&checked_in=1&patron_id=51

(we don't want to get the deleted_items in the checkout history)