From 16c66511e156e01542dc1b1e754823f95abb4f82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc=20V=C3=A9ron?= Date: Tue, 18 Apr 2017 13:56:45 +0200 Subject: [PATCH] Bug 7550 - Self checkout: limit display of patron image to logged-in patron The patron image display in the self-checkout takes a GET parameter from the image source, so if someone copied the image location and substituted the barcode string they could browse through all patron images: To reproduce: - Enable self checkout, go to [Your Server]//cgi-bin/koha/sco/sco-main.pl - Log in with a user 'A' who has a patron image - Copy the address of the patron image into an other browser window - Change the borrowernumber to on of an other user 'B' having a patron image - Verify that the patron image is displayed To test: - Apply patch, restart plack / memcached - Try to reproduce - Verify that you can no longer display the image of user 'B' by tweaking the image address - Log out user 'A' from SCO (click 'Finish') - Try to display image of user 'A', verify that it is not possible - Log out form SCO (go to an other OPAC page) - Try to display image of user 'A', verify that it is not possible --- koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt | 2 +- opac/sco/sco-main.pl | 5 +++++ opac/sco/sco-patron-image.pl | 10 ++++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt index a2ed9c4..dfdd308 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt @@ -204,7 +204,7 @@ [% IF ( display_patron_image ) %]
- +
[% END %] diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index 6518c31..30b6b29 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -47,6 +47,7 @@ use C4::Items; use Koha::DateUtils qw( dt_from_string ); use Koha::Acquisition::Currencies; use Koha::Patron::Images; +use Koha::Patrons; use Koha::Patron::Messages; my $query = new CGI; @@ -299,9 +300,13 @@ if ($borrower->{cardnumber}) { ); if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber}); + my $patron = Koha::Patrons->find($borrower->{borrowernumber}); + my $hash = md5_base64($patron->cardnumber()); + $template->param( display_patron_image => 1, cardnumber => $borrower->{cardnumber}, + ck => md5_base64($patron->cardnumber()), ) if $patron_image; } } else { diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl index e76620b..0161536 100755 --- a/opac/sco/sco-patron-image.pl +++ b/opac/sco/sco-patron-image.pl @@ -22,6 +22,8 @@ use warnings; use C4::Service; use C4::Members; use Koha::Patron::Images; +use Koha::Patrons; +use Digest::MD5 qw(md5_base64); my ($query, $response) = C4::Service->init(circulate => 'self_checkout'); @@ -35,8 +37,16 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { } my ($borrowernumber) = C4::Service->require_params('borrowernumber'); +my ($check) = C4::Service->require_params('ck'); my $patron_image = Koha::Patron::Images->find($borrowernumber); +my $patron = Koha::Patrons->find($borrowernumber); +my $hash = md5_base64($patron->cardnumber()); + +unless ($check && ($check eq $hash) ){ + print $query->header(status => '403 Forbidden - not allowed to display this patron image'); + exit; +} if ($patron_image) { print $query->header( -- 2.1.4