Jonathan Druart
b35dd15a4a
There is no permission needed to access the patronimage.pl script. This means anybody cans access to the patron's images. Test plan: Add an image to borrowernumber 42 and call /cgi-bin/koha/members/patronimage.pl?borrowernumber=42 If you are logged in with borrowers permissions, you will see the image, otherwise you will get a blank page with a 403 header. Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar> |
||
|---|---|---|
| .. | ||
| boraccount.pl | ||
| default_messageprefs.pl | ||
| deletemem.pl | ||
| discharge.pl | ||
| discharges.pl | ||
| files.pl | ||
| guarantor_search.pl | ||
| mancredit.pl | ||
| maninvoice.pl | ||
| member-flags.pl | ||
| member-password.pl | ||
| member.pl | ||
| memberentry.pl | ||
| members-home.pl | ||
| members-update-do.pl | ||
| members-update.pl | ||
| mod_debarment.pl | ||
| moremember.pl | ||
| nl-search.pl | ||
| notices.pl | ||
| patronimage.pl | ||
| pay.pl | ||
| paycollect.pl | ||
| printfeercpt.pl | ||
| printinvoice.pl | ||
| printslip.pl | ||
| purchase-suggestions.pl | ||
| readingrec.pl | ||
| routing-lists.pl | ||
| setstatus.pl | ||
| statistics.pl | ||
| summary-print.pl | ||
| update-child.pl | ||