Attachment 62289 Details for Bug 7550 – [SIGNED-OFF] Bug 7550 - Self checkout: limit display of patron image to logged-in patron

[patch] [SIGNED-OFF] Bug 7550 - Self checkout: limit display of patron image to logged-in patron

SIGNED-OFF-Bug-7550---Self-checkout-limit-display-.patch (text/plain), 4.06 KB, created by Owen Leonard on 2017-04-18 13:18:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Owen Leonard

Created: 2017-04-18 13:18:37 UTC

Size: 4.06 KB

patch

obsolete

>From eaa3d4f0be32771b2409ea989a1f4d50547549a7 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Marc=20V=C3=A9ron?= <veron@veron.ch>
>Date: Tue, 18 Apr 2017 13:56:45 +0200
>Subject: [PATCH] [SIGNED-OFF] Bug 7550 - Self checkout: limit display of
> patron image to logged-in patron
>
>The patron image display in the self-checkout takes a GET parameter from
>the image source, so if someone copied the image location and
>substituted the barcode string they could browse through all patron
>images:
>
><img alt="" src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=XXXX">
>
>To reproduce:
>- Enable self checkout, go to [Your
>  Server]//cgi-bin/koha/sco/sco-main.pl
>- Log in with a user 'A' who has a patron image
>- Copy the address of the patron image into an other browser window
>- Change the borrowernumber to on of an other user 'B' having a patron
>  image
>- Verify that the patron image is displayed
>
>To test:
>- Apply patch, restart plack / memcached
>- Try to reproduce
>- Verify that you can no longer display the image of user 'B' by
>  tweaking the image address
>
>Signed-off-by: Owen Leonard <oleonard@myacpl.org>
>
>https://bugs.koha-community.org/show_bug.cgi?id=7750
>---
> koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt |  2 +-
> opac/sco/sco-main.pl                                     |  5 +++++
> opac/sco/sco-patron-image.pl                             | 10 ++++++++++
> 3 files changed, 16 insertions(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
>index a2ed9c4..dfdd308 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
>@@ -204,7 +204,7 @@
>                 </div> 
>                 [% IF ( display_patron_image ) %]
>                     <div class="span2">
>-                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]" alt="" />
>+                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]&ck=[% ck %]" alt="" />
>                     </div>
>                 [% END %]
>             </div> 
>diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
>index 6518c31..30b6b29 100755
>--- a/opac/sco/sco-main.pl
>+++ b/opac/sco/sco-main.pl
>@@ -47,6 +47,7 @@ use C4::Items;
> use Koha::DateUtils qw( dt_from_string );
> use Koha::Acquisition::Currencies;
> use Koha::Patron::Images;
>+use Koha::Patrons;
> use Koha::Patron::Messages;
> 
> my $query = new CGI;
>@@ -299,9 +300,13 @@ if ($borrower->{cardnumber}) {
>     );
>     if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
>         my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
>+        my $patron = Koha::Patrons->find($borrower->{borrowernumber});
>+        my $hash = md5_base64($patron->cardnumber());
>+
>         $template->param(
>             display_patron_image => 1,
>             cardnumber           => $borrower->{cardnumber},
>+            ck                   => md5_base64($patron->cardnumber()),
>         ) if $patron_image;
>     }
> } else {
>diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl
>index e76620b..0161536 100755
>--- a/opac/sco/sco-patron-image.pl
>+++ b/opac/sco/sco-patron-image.pl
>@@ -22,6 +22,8 @@ use warnings;
> use C4::Service;
> use C4::Members;
> use Koha::Patron::Images;
>+use Koha::Patrons;
>+use Digest::MD5 qw(md5_base64);
> 
> my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
> 
>@@ -35,8 +37,16 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
> }
> 
> my ($borrowernumber) = C4::Service->require_params('borrowernumber');
>+my ($check) = C4::Service->require_params('ck');
> 
> my $patron_image = Koha::Patron::Images->find($borrowernumber);
>+my $patron = Koha::Patrons->find($borrowernumber);
>+my $hash = md5_base64($patron->cardnumber());
>+
>+unless ($check && ($check eq $hash) ){
>+    print $query->header(status => '403 Forbidden - not allowed to display this patron image');
>+    exit;
>+}
> 
> if ($patron_image) {
>     print $query->header(
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 7550: 62271 | 62272 | 62289 | 62311 | 62400 | 62441 | 62912 | 62913