From 9d7e56669f6918879ea9ec2d608652a27dfa7874 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20V=C3=A9ron?= <veron@veron.ch>
Date: Tue, 18 Apr 2017 20:14:40 +0200
Subject: [PATCH] Bug 7550: (follow-up) Use image file to create hash

Follow-up as requested by commment #7
---
 opac/sco/sco-main.pl         |  8 ++------
 opac/sco/sco-patron-image.pl | 13 +++++--------
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index 30b6b29..8f703a7 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -34,7 +34,7 @@
 use Modern::Perl;
 
 use CGI qw ( -utf8 );
-use Digest::MD5 qw(md5_base64);
+use Digest::MD5 qw(md5_hex);
 
 use C4::Auth qw(get_template_and_user checkpw);
 use C4::Koha;
@@ -47,7 +47,6 @@ use C4::Items;
 use Koha::DateUtils qw( dt_from_string );
 use Koha::Acquisition::Currencies;
 use Koha::Patron::Images;
-use Koha::Patrons;
 use Koha::Patron::Messages;
 
 my $query = new CGI;
@@ -300,13 +299,10 @@ if ($borrower->{cardnumber}) {
     );
     if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
         my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
-        my $patron = Koha::Patrons->find($borrower->{borrowernumber});
-        my $hash = md5_base64($patron->cardnumber());
-
         $template->param(
             display_patron_image => 1,
             cardnumber           => $borrower->{cardnumber},
-            ck                   => md5_base64($patron->cardnumber()),
+            ck                   => md5_hex($patron_image->imagefile),
         ) if $patron_image;
     }
 } else {
diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl
index 0161536..539a1be 100755
--- a/opac/sco/sco-patron-image.pl
+++ b/opac/sco/sco-patron-image.pl
@@ -23,7 +23,7 @@ use C4::Service;
 use C4::Members;
 use Koha::Patron::Images;
 use Koha::Patrons;
-use Digest::MD5 qw(md5_base64);
+use Digest::MD5 qw(md5_hex);
 
 my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
 
@@ -40,15 +40,12 @@ my ($borrowernumber) = C4::Service->require_params('borrowernumber');
 my ($check) = C4::Service->require_params('ck');
 
 my $patron_image = Koha::Patron::Images->find($borrowernumber);
-my $patron = Koha::Patrons->find($borrowernumber);
-my $hash = md5_base64($patron->cardnumber());
-
-unless ($check && ($check eq $hash) ){
-    print $query->header(status => '403 Forbidden - not allowed to display this patron image');
-    exit;
-}
 
 if ($patron_image) {
+    unless ( $check eq md5_hex($patron_image->imagefile) ){
+        print $query->header(status => '403 Forbidden - not allowed to display this patron image');
+       exit;
+    }
     print $query->header(
         -type           => $patron_image->mimetype,
         -Content_Length => length( $patron_image->imagefile )
-- 
2.1.4