https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 --- Comment #67 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193742 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193742&action=edit Bug 14962: (QA follow-up) Prevent staff_note from leaking via public API Add public_read_list to Koha::Display to exclude staff_note from the fields returned by public endpoints. The existing $c->objects->to_api mechanism automatically applies the public read list when is_public is set in the stash, which happens automatically for /public/ routes. Also add missing use C4::Context to Koha::REST::V1::Displays, which calls C4::Context->preference in the config() method. Sponsored-by: ByWater Solutions Signed-of-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.