From 65aaaeed576387223fc114d044055a11e20ffb39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20V=C3=A9ron?= <veron@veron.ch>
Date: Tue, 18 Apr 2017 13:56:45 +0200
Subject: [PATCH] Bug 7550 - Self checkout: limit display of patron image to
 logged-in patron

The patron image display in the self-checkout takes a GET parameter from the
image source, so if someone copied the image location and substituted the
barcode string they could browse through all patron images:

<img alt="" src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=XXXX">

To reproduce:
- Enable self checkout, go to [Your Server]//cgi-bin/koha/sco/sco-main.pl
- Log in with a user 'A' who has a patron image
- Copy the address of the patron image into an other browser window
- Change the borrowernumber to on of an other user 'B' having a patron image
- Verify that the patron image is displayed

To test:
- Apply patch, restart plack / memcached
- Try to reproduce
- Verify that you can no longer display the image of user 'B' by
  tweaking the image address
---
 koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt |  2 +-
 opac/sco/sco-main.pl                                     |  5 +++++
 opac/sco/sco-patron-image.pl                             | 10 ++++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
index a2ed9c4..dfdd308 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -204,7 +204,7 @@
                 </div> <!-- / .span12/12 -->
                 [% IF ( display_patron_image ) %]
                     <div class="span2">
-                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]" alt="" />
+                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]&ck=[% ck %]" alt="" />
                     </div>
                 [% END %]
             </div> <!-- / .row-fluid -->
diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index 6518c31..30b6b29 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -47,6 +47,7 @@ use C4::Items;
 use Koha::DateUtils qw( dt_from_string );
 use Koha::Acquisition::Currencies;
 use Koha::Patron::Images;
+use Koha::Patrons;
 use Koha::Patron::Messages;
 
 my $query = new CGI;
@@ -299,9 +300,13 @@ if ($borrower->{cardnumber}) {
     );
     if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
         my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
+        my $patron = Koha::Patrons->find($borrower->{borrowernumber});
+        my $hash = md5_base64($patron->cardnumber());
+
         $template->param(
             display_patron_image => 1,
             cardnumber           => $borrower->{cardnumber},
+            ck                   => md5_base64($patron->cardnumber()),
         ) if $patron_image;
     }
 } else {
diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl
index e76620b..0161536 100755
--- a/opac/sco/sco-patron-image.pl
+++ b/opac/sco/sco-patron-image.pl
@@ -22,6 +22,8 @@ use warnings;
 use C4::Service;
 use C4::Members;
 use Koha::Patron::Images;
+use Koha::Patrons;
+use Digest::MD5 qw(md5_base64);
 
 my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
 
@@ -35,8 +37,16 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
 }
 
 my ($borrowernumber) = C4::Service->require_params('borrowernumber');
+my ($check) = C4::Service->require_params('ck');
 
 my $patron_image = Koha::Patron::Images->find($borrowernumber);
+my $patron = Koha::Patrons->find($borrowernumber);
+my $hash = md5_base64($patron->cardnumber());
+
+unless ($check && ($check eq $hash) ){
+    print $query->header(status => '403 Forbidden - not allowed to display this patron image');
+    exit;
+}
 
 if ($patron_image) {
     print $query->header(
-- 
2.1.4