Koha/opac/sco/sco-patron-image.pl
Jonathan Druart 57f28f9ee4 Bug 7550: SCO - Restrict access of patron's image
With this patch if SelfCheckoutByLogin is set to 'username and
password', only the logged in user will be able to see the image linked
to his/her logged in account.
If set to "barcode" we generate a token but it can be easily generated.
You should add a warning in the about page if
SelfCheckoutByLogin="barcode" and ShowPatronImageInWebBasedSelfCheck="Show".

How I tested:
- Go to SCO
- Log - Enable self checkout, go to [Your
  Server]//cgi-bin/koha/sco/sco-main.pl
- Log in with a user 'A' who has a patron image
- Copy the address of the patron image into an other browser window
- Change the borrowernumber to on of an other user 'B' having a patron
  image
- Verify that the patron image is NOT displayed

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-05-08 09:00:26 -04:00

69 lines
2.1 KiB
Perl
Executable file

#!/usr/bin/perl
#
# Copyright 2009 LibLime
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.
use strict;
use warnings;
use C4::Service;
use C4::Members;
use Koha::Patron::Images;
use Koha::Patrons;
use Koha::Token;
my ($query, $response) = C4::Service->init(circulate => 'self_checkout');
unless (C4::Context->preference('WebBasedSelfCheck')) {
print $query->header(status => '403 Forbidden - web-based self-check not enabled');
exit;
}
unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
print $query->header(status => '403 Forbidden - displaying patron images in self-check not enabled');
exit;
}
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
my ($csrf_token) = C4::Service->require_params('csrf_token');
my $patron = Koha::Patrons->find( $borrowernumber );
my $patron_image = $patron->image;
if ($patron_image) {
unless (
Koha::Token->new->check_csrf(
{
session_id => scalar $query->cookie('CGISESSID')
. $patron->cardnumber,
id => $patron->userid,
token => $csrf_token,
}
)
)
{
print $query->header(-type => 'text/plain', -status => '403 Forbidden');
exit;
}
print $query->header(
-type => $patron_image->mimetype,
-Content_Length => length( $patron_image->imagefile )
),
$patron_image->imagefile;
} else {
print $query->header(status => '404 patron image not found');
}