View | Details | Raw Unified | Return to bug 7550
Collapse All | Expand All

(-)a/opac/sco/sco-main.pl (-6 / +2 lines)
Lines 34-40 Link Here
34
use Modern::Perl;
34
use Modern::Perl;
35
35
36
use CGI qw ( -utf8 );
36
use CGI qw ( -utf8 );
37
use Digest::MD5 qw(md5_base64);
37
use Digest::MD5 qw(md5_hex);
38
38
39
use C4::Auth qw(get_template_and_user checkpw);
39
use C4::Auth qw(get_template_and_user checkpw);
40
use C4::Koha;
40
use C4::Koha;
Lines 47-53 use C4::Items; Link Here
47
use Koha::DateUtils qw( dt_from_string );
47
use Koha::DateUtils qw( dt_from_string );
48
use Koha::Acquisition::Currencies;
48
use Koha::Acquisition::Currencies;
49
use Koha::Patron::Images;
49
use Koha::Patron::Images;
50
use Koha::Patrons;
51
use Koha::Patron::Messages;
50
use Koha::Patron::Messages;
52
51
53
my $query = new CGI;
52
my $query = new CGI;
Lines 300-312 if ($borrower->{cardnumber}) { Link Here
300
    );
299
    );
301
    if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
300
    if (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
302
        my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
301
        my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
303
        my $patron = Koha::Patrons->find($borrower->{borrowernumber});
304
        my $hash = md5_base64($patron->cardnumber());
305
306
        $template->param(
302
        $template->param(
307
            display_patron_image => 1,
303
            display_patron_image => 1,
308
            cardnumber           => $borrower->{cardnumber},
304
            cardnumber           => $borrower->{cardnumber},
309
            ck                   => md5_base64($patron->cardnumber()),
305
            ck                   => md5_hex($patron_image->imagefile),
310
        ) if $patron_image;
306
        ) if $patron_image;
311
    }
307
    }
312
} else {
308
} else {
(-)a/opac/sco/sco-patron-image.pl (-9 / +5 lines)
Lines 23-29 use C4::Service; Link Here
23
use C4::Members;
23
use C4::Members;
24
use Koha::Patron::Images;
24
use Koha::Patron::Images;
25
use Koha::Patrons;
25
use Koha::Patrons;
26
use Digest::MD5 qw(md5_base64);
26
use Digest::MD5 qw(md5_hex);
27
27
28
my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
28
my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
29
29
Lines 40-54 my ($borrowernumber) = C4::Service->require_params('borrowernumber'); Link Here
40
my ($check) = C4::Service->require_params('ck');
40
my ($check) = C4::Service->require_params('ck');
41
41
42
my $patron_image = Koha::Patron::Images->find($borrowernumber);
42
my $patron_image = Koha::Patron::Images->find($borrowernumber);
43
my $patron = Koha::Patrons->find($borrowernumber);
44
my $hash = md5_base64($patron->cardnumber());
45
46
unless ($check && ($check eq $hash) ){
47
    print $query->header(status => '403 Forbidden - not allowed to display this patron image');
48
    exit;
49
}
50
43
51
if ($patron_image) {
44
if ($patron_image) {
45
    unless ( $check eq md5_hex($patron_image->imagefile) ){
46
        print $query->header(status => '403 Forbidden - not allowed to display this patron image');
47
       exit;
48
    }
52
    print $query->header(
49
    print $query->header(
53
        -type           => $patron_image->mimetype,
50
        -type           => $patron_image->mimetype,
54
        -Content_Length => length( $patron_image->imagefile )
51
        -Content_Length => length( $patron_image->imagefile )
55
- 

Return to bug 7550