From bcf64aeeb810a185d5a9e297e45b2952876fceca Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 12 Jan 2026 02:05:47 +0000 Subject: [PATCH] Bug 41594: Disable access to invoice-files.pl if AcqEnableFiles disabled This patch makes it so that invoice-files.pl returns 404 if AcqEnableFiles is disabled Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999 3. Note that you see a 404 page 4. Change "AcqEnableFiles" syspref to "Do" 5. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999 6. Note that you now see a "Files for invoice" page Signed-off-by: Jonathan Druart Signed-off-by: Marcel de Rooy --- acqui/invoice-files.pl | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/acqui/invoice-files.pl b/acqui/invoice-files.pl index 35a6f23811..45552a018a 100755 --- a/acqui/invoice-files.pl +++ b/acqui/invoice-files.pl @@ -30,8 +30,8 @@ Manage files associated with invoice use Modern::Perl; use CGI; -use C4::Auth qw( get_template_and_user ); -use C4::Output qw( output_html_with_http_headers ); +use C4::Auth qw( get_template_and_user ); +use C4::Output qw( output_html_with_http_headers output_error ); use C4::Acquisition qw( GetInvoice GetInvoiceDetails ); use Koha::Misc::Files; @@ -45,6 +45,10 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user( } ); +if ( !C4::Context->preference('AcqEnableFiles') ) { + output_error( $input, '404' ); +} + my $invoiceid = $input->param('invoiceid') // ''; my $op = $input->param('op') // ''; my %errors;