Koha-community
/
Koha
13
5
Fork 0
Code Issues Releases Wiki Activity
Browse Source

Bug 11662: remove disused member-picupload.pl 

This script is no longer used, and in addition has problematic
handling of its parameters that could lead to writing to
arbitrary files on the server.

To test:

[1] Verify that member-picupload.pl is no longer referred
    to in the codebase after applying this patch.
[2] Verify that there are no regressions in patron
    photo management.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Found no regressions in removing this script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
3.16.x
Galen Charlton 10 years ago
parent
7baf02c263
commit
939079de75
1 changed files with 0 additions and 77 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 77
      members/member-picupload.pl

77
members/member-picupload.pl
View File

@ -1,77 +0,0 @@
#!/usr/bin/perl
# script to upload a picture to a borrowerimages directory.
# checks to see if its either displaying the upload form
# or doing the actual upload.
# written by Waylon Robertson (genjimoto@sourceforge) 2005/08/22
# Copyright 2000-2002 Katipo Communications
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with Koha; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
use strict;
use warnings;
use C4::Auth;
use C4::Context;
use C4::Output;
use CGI;
my $input = new CGI;
my $name = $input->param('name');
my $borrowernumber = $input->param('borrowernumber');
my $photo = $input->param('photo');
my $template_name;
my $htdocs = C4::Context->config('intrahtdocs');
my $upload_dir = $htdocs."/borrowerimages";
if($photo eq ""){
$template_name = "members/member-picupload.tmpl";
} else {
$template_name = "members/moremember.tmpl";
}
my ($template, $loggedinuser, $cookie)
= get_template_and_user({template_name => $template_name,
query => $input,
type => "intranet",
authnotrequired => 0,
flagsrequired => {borrowers => 1},
debug => 1,
});
if ($photo){
my $filename=$borrowernumber.'.jpg';
my $upload_filehandle = $input->upload("photo");
open (my $upload_fh, '>', "$upload_dir/$filename");
binmode $upload_fh;
while ( <$upload_filehandle> )
{
print $upload_fh;
}
close $upload_fh;
}
else {
$template->param(
borrowernumber => $borrowernumber,
name => $name
);
output_html_with_http_headers $input, $cookie, $template->output;
}
print $input->redirect("http://intranet/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
Write Preview
Loading…
Cancel
Save