https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40898 --- Comment #1 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 208834 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208834&action=edit Bug 40898: Limit Patron REST API sorting columns 1. Apply the patch and run the database update. 2. Navigate to **Administration → System preferences → Web services**. 3. Verify that the new `PatronSearchMaxSortColumns` system preference exists and defaults to `3`. 4. While authenticated in the Koha staff interface, navigate to the following URL to test sorting by three columns: `http://localhost:8081/api/v1/patrons?_order_by=surname,firstname,cardnumber` Confirm the request succeeds and returns a JSON array of patrons (HTTP 200). 5. Navigate to the following URL to test sorting by four columns: `http://localhost:8081/api/v1/patrons?_order_by=surname,firstname,cardnumber,patron_id` Confirm the request returns HTTP 400 with the following error: `"The maximum number of sorting columns (3) has been exceeded."` 6. Change `PatronSearchMaxSortColumns` to `2` and repeat the three-column request: `http://localhost:8081/api/v1/patrons?_order_by=surname,firstname,cardnumber` Confirm the request returns HTTP 400 with the following error: `"The maximum number of sorting columns (2) has been exceeded."` 7. Run the automated tests: `prove -v t/db_dependent/api/v1/patrons.t` Confirm all tests pass with no warnings. -- You are receiving this mail because: You are watching all bug changes.