From 7ce7fae762082a1619e509970134795b9fbb6c65 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 19 Apr 2017 14:09:12 -0300 Subject: [PATCH] Bug 7550: SCO - Restrict access of patron's image With this patch if SelfCheckoutByLogin is set to 'username and password', only the logged in user will be able to see the image linked to his/her logged in account. If set to "barcode" we generate a token but it can be easily generated. You should add a warning in the about page if SelfCheckoutByLogin="barcode" and ShowPatronImageInWebBasedSelfCheck="Show". --- .../opac-tmpl/bootstrap/en/modules/sco/sco-main.tt | 2 +- opac/sco/sco-main.pl | 3 ++- opac/sco/sco-patron-image.pl | 22 +++++++++++++++++++++- 3 files changed, 24 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt index a2ed9c4..f7fae7b 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt @@ -204,7 +204,7 @@ [% IF ( display_patron_image ) %]
- +
[% END %] diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index 6518c31..4153277 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -34,7 +34,6 @@ use Modern::Perl; use CGI qw ( -utf8 ); -use Digest::MD5 qw(md5_base64); use C4::Auth qw(get_template_and_user checkpw); use C4::Koha; @@ -48,6 +47,7 @@ use Koha::DateUtils qw( dt_from_string ); use Koha::Acquisition::Currencies; use Koha::Patron::Images; use Koha::Patron::Messages; +use Koha::Token; my $query = new CGI; @@ -302,6 +302,7 @@ if ($borrower->{cardnumber}) { $template->param( display_patron_image => 1, cardnumber => $borrower->{cardnumber}, + csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $borrower->{cardnumber}, id => $borrower->{userid}} ), ) if $patron_image; } } else { diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl index e76620b..dc6fbc8 100755 --- a/opac/sco/sco-patron-image.pl +++ b/opac/sco/sco-patron-image.pl @@ -22,6 +22,8 @@ use warnings; use C4::Service; use C4::Members; use Koha::Patron::Images; +use Koha::Patrons; +use Koha::Token; my ($query, $response) = C4::Service->init(circulate => 'self_checkout'); @@ -35,10 +37,28 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { } my ($borrowernumber) = C4::Service->require_params('borrowernumber'); +my ($csrf_token) = C4::Service->require_params('csrf_token'); -my $patron_image = Koha::Patron::Images->find($borrowernumber); +my $patron = Koha::Patrons->find( $borrowernumber ); +my $patron_image = $patron->image; if ($patron_image) { + + unless ( + Koha::Token->new->check_csrf( + { + session_id => scalar $query->cookie('CGISESSID') + . $patron->cardnumber, + id => $patron->userid, + token => $csrf_token, + } + ) + ) + { + + print $query->header(-type => 'text/plain', -status => '403 Forbidden'); + exit; + } print $query->header( -type => $patron_image->mimetype, -Content_Length => length( $patron_image->imagefile ) -- 2.9.3