@@ -, +, @@
logged-in patron
- Enable self checkout, go to [Your Server]//cgi-bin/koha/sco/sco-main.pl
- Log in with a user 'A' who has a patron image
- Copy the address of the patron image into an other browser window
- Change the borrowernumber to on of an other user 'B' having a patron image
- Verify that the patron image is displayed
- Apply patch, restart plack / memcached
- Try to reproduce
- Verify that you can no longer display the image of user 'B' by
tweaking the image address
---
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt | 2 +-
opac/sco/sco-main.pl | 5 +++++
opac/sco/sco-patron-image.pl | 10 ++++++++++
3 files changed, 16 insertions(+), 1 deletion(-)
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -204,7 +204,7 @@
[% IF ( display_patron_image ) %]
-
+
[% END %]
--- a/opac/sco/sco-main.pl
+++ a/opac/sco/sco-main.pl
@@ -47,6 +47,7 @@ use C4::Items;
use Koha::DateUtils qw( dt_from_string );
use Koha::Acquisition::Currencies;
use Koha::Patron::Images;
+use Koha::Patrons;
use Koha::Patron::Messages;
my $query = new CGI;
@@ -299,9 +300,13 @@ if ($borrower->{cardnumber}) {
);
if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
+ my $patron = Koha::Patrons->find($borrower->{borrowernumber});
+ my $hash = md5_base64($patron->cardnumber());
+
$template->param(
display_patron_image => 1,
cardnumber => $borrower->{cardnumber},
+ ck => md5_base64($patron->cardnumber()),
) if $patron_image;
}
} else {
--- a/opac/sco/sco-patron-image.pl
+++ a/opac/sco/sco-patron-image.pl
@@ -22,6 +22,8 @@ use warnings;
use C4::Service;
use C4::Members;
use Koha::Patron::Images;
+use Koha::Patrons;
+use Digest::MD5 qw(md5_base64);
my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
@@ -35,8 +37,16 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
}
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
+my ($check) = C4::Service->require_params('ck');
my $patron_image = Koha::Patron::Images->find($borrowernumber);
+my $patron = Koha::Patrons->find($borrowernumber);
+my $hash = md5_base64($patron->cardnumber());
+
+unless ($check && ($check eq $hash) ){
+ print $query->header(status => '403 Forbidden - not allowed to display this patron image');
+ exit;
+}
if ($patron_image) {
print $query->header(
--