From c4c19d006ac41fabe5ed3eb47ac1bc2281f2ab49 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Mon, 22 Nov 2021 15:29:58 +0100
Subject: [PATCH] Bug 29541: Restrict access to patron's image to borrowers =>
 * and circulate => *

The patron images is displayed on the 'circulation' and 'members'
modules.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 members/patronimage.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/members/patronimage.pl b/members/patronimage.pl
index 8a304e300b..81f5225cd6 100755
--- a/members/patronimage.pl
+++ b/members/patronimage.pl
@@ -47,7 +47,7 @@ This script, when called from within HTML and passed a valid patron borrowernumb
 
 =cut
 
-my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => 1 } );
+my ($status, $cookie, $sessionID) = check_api_auth($query, [ { borrowers => '*' }, { circulate => '*' } ] );
 
 unless ( $status eq 'ok' ) {
     print $query->header(-type => 'text/plain', -status => '403 Forbidden');
-- 
2.39.5