https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23998
--- Comment #46 from Tomás Cohen Arazi (tcohen) <[email protected]> --- Created attachment 208930 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208930&action=edit Bug 23998: (follow-up) Fix validation and error handling in the messages controller This patch fixes several problems in Koha::REST::V1::Messages: - `blessed` was not imported, so `blessed $_` compiled as the method call `$_->blessed`, which explodes on non-object exceptions. - POST and PUT/PATCH did not check the patron is visible to the logged in user. A librarian restricted by library groups could create messages for any patron, or move a message to a patron they cannot see. Both now return 400 with `invalid_patron_id`. - A non-existent patron_id or manager_id led to a 500. They now return 400 with `invalid_patron_id` / `invalid_manager_id`. - `messages.branchcode` has no FK, so any string was stored as library_id. It is now validated (`invalid_library_id`). A null library_id still defaults to the user library on POST. - The ad-hoc 'cannot be empty' checks (400 without error_code) are replaced by the spec constraints from the previous patch and the validation above. - The message lookup in update/delete is moved inside the try block (REST4.0) and shared in `_get_editable_message`. - POST reuses the stored object instead of refetching it, and the unreachable 409 is removed from the spec (message_id is read-only). Test plan: 1. Apply this patch 2. Run: $ ktd --shell k$ yarn api:bundle k$ restart_all k$ prove t/db_dependent/api/v1/messages.t xt/api.t => SUCCESS: Tests pass! 3. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
