Attachment 62400 Details for Bug 7550 – [ALTERNATIVE-PATCH] Bug 7550: SCO - Restrict access of patron's image

[patch] [ALTERNATIVE-PATCH] Bug 7550: SCO - Restrict access of patron's image

Bug-7550-SCO---Restrict-access-of-patrons-image.patch (text/plain), 3.83 KB, created by Jonathan Druart on 2017-04-19 17:12:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2017-04-19 17:12:28 UTC

Size: 3.83 KB

patch

obsolete

>From 7ce7fae762082a1619e509970134795b9fbb6c65 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Wed, 19 Apr 2017 14:09:12 -0300
>Subject: [PATCH] Bug 7550: SCO - Restrict access of patron's image
>
>With this patch if SelfCheckoutByLogin is set to 'username and
>password', only the logged in user will be able to see the image linked
>to his/her logged in account.
>If set to "barcode" we generate a token but it can be easily generated.
>You should add a warning in the about page if
>SelfCheckoutByLogin="barcode" and ShowPatronImageInWebBasedSelfCheck="Show".
>---
> .../opac-tmpl/bootstrap/en/modules/sco/sco-main.tt |  2 +-
> opac/sco/sco-main.pl                               |  3 ++-
> opac/sco/sco-patron-image.pl                       | 22 +++++++++++++++++++++-
> 3 files changed, 24 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
>index a2ed9c4..f7fae7b 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
>@@ -204,7 +204,7 @@
>                 </div> 
>                 [% IF ( display_patron_image ) %]
>                     <div class="span2">
>-                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]" alt="" />
>+                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]&csrf_token=[% csrf_token %]" alt="" />
>                     </div>
>                 [% END %]
>             </div> 
>diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
>index 6518c31..4153277 100755
>--- a/opac/sco/sco-main.pl
>+++ b/opac/sco/sco-main.pl
>@@ -34,7 +34,6 @@
> use Modern::Perl;
> 
> use CGI qw ( -utf8 );
>-use Digest::MD5 qw(md5_base64);
> 
> use C4::Auth qw(get_template_and_user checkpw);
> use C4::Koha;
>@@ -48,6 +47,7 @@ use Koha::DateUtils qw( dt_from_string );
> use Koha::Acquisition::Currencies;
> use Koha::Patron::Images;
> use Koha::Patron::Messages;
>+use Koha::Token;
> 
> my $query = new CGI;
> 
>@@ -302,6 +302,7 @@ if ($borrower->{cardnumber}) {
>         $template->param(
>             display_patron_image => 1,
>             cardnumber           => $borrower->{cardnumber},
>+            csrf_token           => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $borrower->{cardnumber}, id => $borrower->{userid}} ),
>         ) if $patron_image;
>     }
> } else {
>diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl
>index e76620b..dc6fbc8 100755
>--- a/opac/sco/sco-patron-image.pl
>+++ b/opac/sco/sco-patron-image.pl
>@@ -22,6 +22,8 @@ use warnings;
> use C4::Service;
> use C4::Members;
> use Koha::Patron::Images;
>+use Koha::Patrons;
>+use Koha::Token;
> 
> my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
> 
>@@ -35,10 +37,28 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
> }
> 
> my ($borrowernumber) = C4::Service->require_params('borrowernumber');
>+my ($csrf_token) = C4::Service->require_params('csrf_token');
> 
>-my $patron_image = Koha::Patron::Images->find($borrowernumber);
>+my $patron = Koha::Patrons->find( $borrowernumber );
>+my $patron_image = $patron->image;
> 
> if ($patron_image) {
>+
>+    unless (
>+        Koha::Token->new->check_csrf(
>+            {
>+                session_id => scalar $query->cookie('CGISESSID')
>+                  . $patron->cardnumber,
>+                id => $patron->userid,
>+                token => $csrf_token,
>+            }
>+        )
>+      )
>+    {
>+
>+        print $query->header(-type => 'text/plain', -status => '403 Forbidden');
>+        exit;
>+    }
>     print $query->header(
>         -type           => $patron_image->mimetype,
>         -Content_Length => length( $patron_image->imagefile )
>-- 
>2.9.3

Actions: View | Diff | Splinter Review

Attachments on bug 7550: 62271 | 62272 | 62289 | 62311 | 62400 | 62441 | 62912 | 62913