]> git.koha-community.org Git - koha.git/commit
Bug 14566: Fix permissions in patronimage.pl
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 19 Aug 2015 14:42:10 +0000 (15:42 +0100)
committerChris Cormack <chrisc@catalyst.net.nz>
Sun, 23 Aug 2015 22:15:07 +0000 (10:15 +1200)
commitec2297d075dbed0837c766db768defec173b4001
tree473f6841e7c98ad2db801abd354119162b050999
parent13385111dcd98af10f06593461e8225a0ced5b97
Bug 14566: Fix permissions in patronimage.pl

There is no permission needed to access the patronimage.pl script.
This means anybody cans access to the patron's images.

Test plan:
Add an image to borrowernumber 42 and call
/cgi-bin/koha/members/patronimage.pl?borrowernumber=42

If you are logged in with borrowers permissions, you will see the image,
otherwise you will get a blank page with a 403 header.

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
members/patronimage.pl