View | Details | Raw Unified | Return to bug 7550
Collapse All | Expand All

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt (-1 / +1 lines)
Lines 204-210 Link Here
204
                </div> <!-- / .span12/12 -->
204
                </div> <!-- / .span12/12 -->
205
                [% IF ( display_patron_image ) %]
205
                [% IF ( display_patron_image ) %]
206
                    <div class="span2">
206
                    <div class="span2">
207
                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]" alt="" />
207
                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]&csrf_token=[% csrf_token %]" alt="" />
208
                    </div>
208
                    </div>
209
                [% END %]
209
                [% END %]
210
            </div> <!-- / .row-fluid -->
210
            </div> <!-- / .row-fluid -->
(-)a/opac/sco/sco-main.pl (-1 / +2 lines)
Lines 34-40 Link Here
34
use Modern::Perl;
34
use Modern::Perl;
35
35
36
use CGI qw ( -utf8 );
36
use CGI qw ( -utf8 );
37
use Digest::MD5 qw(md5_base64);
38
37
39
use C4::Auth qw(get_template_and_user checkpw);
38
use C4::Auth qw(get_template_and_user checkpw);
40
use C4::Koha;
39
use C4::Koha;
Lines 48-53 use Koha::DateUtils qw( dt_from_string ); Link Here
48
use Koha::Acquisition::Currencies;
47
use Koha::Acquisition::Currencies;
49
use Koha::Patron::Images;
48
use Koha::Patron::Images;
50
use Koha::Patron::Messages;
49
use Koha::Patron::Messages;
50
use Koha::Token;
51
51
52
my $query = new CGI;
52
my $query = new CGI;
53
53
Lines 302-307 if ($borrower->{cardnumber}) { Link Here
302
        $template->param(
302
        $template->param(
303
            display_patron_image => 1,
303
            display_patron_image => 1,
304
            cardnumber           => $borrower->{cardnumber},
304
            cardnumber           => $borrower->{cardnumber},
305
            csrf_token           => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $borrower->{cardnumber}, id => $borrower->{userid}} ),
305
        ) if $patron_image;
306
        ) if $patron_image;
306
    }
307
    }
307
} else {
308
} else {
(-)a/opac/sco/sco-patron-image.pl (-2 / +21 lines)
Lines 22-27 use warnings; Link Here
22
use C4::Service;
22
use C4::Service;
23
use C4::Members;
23
use C4::Members;
24
use Koha::Patron::Images;
24
use Koha::Patron::Images;
25
use Koha::Patrons;
26
use Koha::Token;
25
27
26
my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
28
my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
27
29
Lines 35-44 unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { Link Here
35
}
37
}
36
38
37
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
39
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
40
my ($csrf_token) = C4::Service->require_params('csrf_token');
38
41
39
my $patron_image = Koha::Patron::Images->find($borrowernumber);
42
my $patron = Koha::Patrons->find( $borrowernumber );
43
my $patron_image = $patron->image;
40
44
41
if ($patron_image) {
45
if ($patron_image) {
46
47
    unless (
48
        Koha::Token->new->check_csrf(
49
            {
50
                session_id => scalar $query->cookie('CGISESSID')
51
                  . $patron->cardnumber,
52
                id => $patron->userid,
53
                token => $csrf_token,
54
            }
55
        )
56
      )
57
    {
58
59
        print $query->header(-type => 'text/plain', -status => '403 Forbidden');
60
        exit;
61
    }
42
    print $query->header(
62
    print $query->header(
43
        -type           => $patron_image->mimetype,
63
        -type           => $patron_image->mimetype,
44
        -Content_Length => length( $patron_image->imagefile )
64
        -Content_Length => length( $patron_image->imagefile )
45
- 

Return to bug 7550