Attachment #62912 for bug #7550

View | Details | Raw Unified | Return to bug 7550
Collapse All | Expand All

Lines 204-210 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt (-1 / +1 lines)
204	</div> <!-- / .span12/12 -->	204	</div> <!-- / .span12/12 -->
205	[% IF ( display_patron_image ) %]	205	[% IF ( display_patron_image ) %]
206	<div class="span2">	206	<div class="span2">
207	<img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]" alt="" />	207	<img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]&csrf_token=[% csrf_token %]" alt="" />
208	</div>	208	</div>
209	[% END %]	209	[% END %]
210	</div> <!-- / .row-fluid -->	210	</div> <!-- / .row-fluid -->




use Modern::Perl;

use CGI qw ( -utf8 );
use Digest::MD5 qw(md5_base64);

use C4::Auth qw(get_template_and_user checkpw);
use C4::Koha;

use Koha::Acquisition::Currencies;
use Koha::Patron::Images;
use Koha::Patron::Messages;
use Koha::Token;

my $query = new CGI;


        $template->param(
            display_patron_image => 1,
            cardnumber           => $borrower->{cardnumber},
            csrf_token           => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $borrower->{cardnumber}, id => $borrower->{userid}} ),
        ) if $patron_image;
    }
} else {

Lines 22-27 use warnings; Link Here

(-)a/opac/sco/sco-patron-image.pl (-2 / +21 lines)
22	use C4::Service;	22	use C4::Service;
23	use C4::Members;	23	use C4::Members;
24	use Koha::Patron::Images;	24	use Koha::Patron::Images;
		25	use Koha::Patrons;
		26	use Koha::Token;
25		27
26	my ($query, $response) = C4::Service->init(circulate => 'self_checkout');	28	my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
27		29
Lines 35-44 unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { Link Here
35	}	37	}
36		38
37	my ($borrowernumber) = C4::Service->require_params('borrowernumber');	39	my ($borrowernumber) = C4::Service->require_params('borrowernumber');
		40	my ($csrf_token) = C4::Service->require_params('csrf_token');
38		41
39	my $patron_image = Koha::Patron::Images->find($borrowernumber);	42	my $patron = Koha::Patrons->find( $borrowernumber );
		43	my $patron_image = $patron->image;
40		44
41	if ($patron_image) {	45	if ($patron_image) {
		46
		47	unless (
		48	Koha::Token->new->check_csrf(
		49	{
		50	session_id => scalar $query->cookie('CGISESSID')
		51	. $patron->cardnumber,
		52	id => $patron->userid,
		53	token => $csrf_token,
		54	}
		55	)
		56	)
		57	{
		58
		59	print $query->header(-type => 'text/plain', -status => '403 Forbidden');
		60	exit;
		61	}
42	print $query->header(	62	print $query->header(
43	-type => $patron_image->mimetype,	63	-type => $patron_image->mimetype,
44	-Content_Length => length( $patron_image->imagefile )	64	-Content_Length => length( $patron_image->imagefile )
45	-

Return to bug 7550

Lines 34-40 Link Here

(-)a/opac/sco/sco-main.pl (-1 / +2 lines)
34	use Modern::Perl;	34	use Modern::Perl;
35		35
36	use CGI qw ( -utf8 );	36	use CGI qw ( -utf8 );
37	use Digest::MD5 qw(md5_base64);
38		37
39	use C4::Auth qw(get_template_and_user checkpw);	38	use C4::Auth qw(get_template_and_user checkpw);
40	use C4::Koha;	39	use C4::Koha;
Lines 48-53 use Koha::DateUtils qw( dt_from_string ); Link Here
48	use Koha::Acquisition::Currencies;	47	use Koha::Acquisition::Currencies;
49	use Koha::Patron::Images;	48	use Koha::Patron::Images;
50	use Koha::Patron::Messages;	49	use Koha::Patron::Messages;
		50	use Koha::Token;
51		51
52	my $query = new CGI;	52	my $query = new CGI;
53		53
Lines 302-307 if ($borrower->{cardnumber}) { Link Here
302	$template->param(	302	$template->param(
303	display_patron_image => 1,	303	display_patron_image => 1,
304	cardnumber => $borrower->{cardnumber},	304	cardnumber => $borrower->{cardnumber},
		305	csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $borrower->{cardnumber}, id => $borrower->{userid}} ),
305	) if $patron_image;	306	) if $patron_image;
306	}	307	}
307	} else {	308	} else {