From 9d7e56669f6918879ea9ec2d608652a27dfa7874 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc=20V=C3=A9ron?= Date: Tue, 18 Apr 2017 20:14:40 +0200 Subject: [PATCH] Bug 7550: (follow-up) Use image file to create hash Follow-up as requested by commment #7 --- opac/sco/sco-main.pl | 8 ++------ opac/sco/sco-patron-image.pl | 13 +++++-------- 2 files changed, 7 insertions(+), 14 deletions(-) diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index 30b6b29..8f703a7 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -34,7 +34,7 @@ use Modern::Perl; use CGI qw ( -utf8 ); -use Digest::MD5 qw(md5_base64); +use Digest::MD5 qw(md5_hex); use C4::Auth qw(get_template_and_user checkpw); use C4::Koha; @@ -47,7 +47,6 @@ use C4::Items; use Koha::DateUtils qw( dt_from_string ); use Koha::Acquisition::Currencies; use Koha::Patron::Images; -use Koha::Patrons; use Koha::Patron::Messages; my $query = new CGI; @@ -300,13 +299,10 @@ if ($borrower->{cardnumber}) { ); if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber}); - my $patron = Koha::Patrons->find($borrower->{borrowernumber}); - my $hash = md5_base64($patron->cardnumber()); - $template->param( display_patron_image => 1, cardnumber => $borrower->{cardnumber}, - ck => md5_base64($patron->cardnumber()), + ck => md5_hex($patron_image->imagefile), ) if $patron_image; } } else { diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl index 0161536..539a1be 100755 --- a/opac/sco/sco-patron-image.pl +++ b/opac/sco/sco-patron-image.pl @@ -23,7 +23,7 @@ use C4::Service; use C4::Members; use Koha::Patron::Images; use Koha::Patrons; -use Digest::MD5 qw(md5_base64); +use Digest::MD5 qw(md5_hex); my ($query, $response) = C4::Service->init(circulate => 'self_checkout'); @@ -40,15 +40,12 @@ my ($borrowernumber) = C4::Service->require_params('borrowernumber'); my ($check) = C4::Service->require_params('ck'); my $patron_image = Koha::Patron::Images->find($borrowernumber); -my $patron = Koha::Patrons->find($borrowernumber); -my $hash = md5_base64($patron->cardnumber()); - -unless ($check && ($check eq $hash) ){ - print $query->header(status => '403 Forbidden - not allowed to display this patron image'); - exit; -} if ($patron_image) { + unless ( $check eq md5_hex($patron_image->imagefile) ){ + print $query->header(status => '403 Forbidden - not allowed to display this patron image'); + exit; + } print $query->header( -type => $patron_image->mimetype, -Content_Length => length( $patron_image->imagefile ) -- 2.1.4