@@ -, +, @@ - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx - Log out and retest the page patronimage.pl --- members/patronimage.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/members/patronimage.pl +++ a/members/patronimage.pl @@ -48,7 +48,7 @@ This script, when called from within HTML and passed a valid patron borrowernumb =cut -my ($status, $cookie, $sessionID) = check_api_auth($query, { borrowers => 1} ); +my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => 1 } ); unless ( $status eq 'ok' ) { print $query->header(-type => 'text/plain', -status => '403 Forbidden'); --