From aa8be6ae766918bce27fc756594c6f42f08aaeb3 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 12 Jan 2026 02:05:47 +0000 Subject: [PATCH] Bug 41594: [25.05.x] Disable access to invoice-files.pl if AcqEnableFiles disabled This patch makes it so that invoice-files.pl returns 404 if AcqEnableFiles is disabled Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999 3. Note that you see a 404 page 4. Change "AcqEnableFiles" syspref to "Do" 5. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999 6. Note that you now see a "Files for invoice" page Signed-off-by: Jonathan Druart Signed-off-by: Marcel de Rooy Signed-off-by: Lucas Gass --- acqui/invoice-files.pl | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/acqui/invoice-files.pl b/acqui/invoice-files.pl index 39ab34d51e..736b378b0c 100755 --- a/acqui/invoice-files.pl +++ b/acqui/invoice-files.pl @@ -31,7 +31,7 @@ use Modern::Perl; use CGI; use C4::Auth qw( get_template_and_user ); -use C4::Output qw( output_html_with_http_headers ); +use C4::Output qw( output_html_with_http_headers output_error ); use C4::Acquisition qw( GetInvoice GetInvoiceDetails ); use Koha::Misc::Files; @@ -45,6 +45,10 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user( } ); +if ( !C4::Context->preference('AcqEnableFiles') ) { + output_error( $input, '404' ); +} + my $invoiceid = $input->param('invoiceid') // ''; my $op = $input->param('op') // ''; my %errors;