Bug 40920 - Checkout endpoint crashes with parameter "patron_id"
Summary: Checkout endpoint crashes with parameter "patron_id"
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: 24.11
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-10-01 07:18 UTC by Arthur Suzuki
Modified: 2025-10-01 07:48 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40920: fix invalid patron_id parameter (1.10 KB, patch)
2025-10-01 07:28 UTC, Arthur Suzuki
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Arthur Suzuki 2025-10-01 07:18:13 UTC
A call to /api/v1/checkouts?patron_id=51 crashes Koha.

We get this in the logs:
Unknown column 'patron_id' in 'WHERE' at /home/koha/src/Koha/REST/Plugin/Objects.pm

I tried to replace patron_id parameter with "borrowernumber" in the request but it crashes as well as borrowernumber is not a valid input.
This is a regression from 23.11 we experienced in 24.11 and main.
I've made a small patch to solve this but there is probably a better way to do it.
Comment 1 Arthur Suzuki 2025-10-01 07:28:47 UTC
Created attachment 187160 [details] [review]
Bug 40920: fix invalid patron_id parameter

Test plan:
- on KTD, without patch, create an issue for user "koha" (patron_id 51)
- go to http://localhost:8081/api/v1/checkouts?patron_id=51
- you should get an error (and no issues)
- in /var/log/koha/plack-api-error.log you will see "Unknown column 'patron_id'".
- apply patch and "restart_all"
- make the same request to the api
- you should see the issue for user koha.
Comment 2 Arthur Suzuki 2025-10-01 07:48:17 UTC
to be more specific, the failing request is the following :
http://localhost:8081//api/v1/checkouts?q={%22item_id%22:{%22-not_like%22:%22null%22}}&_match=exact&_page=1&_per_page=20&checked_in=1&patron_id=51

(we don't want to get the deleted_items in the checkout history)