Bug 29541: Prevent users from another group to access patron's images
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Mon, 6 Dec 2021 12:58:25 +0000 (13:58 +0100)
committerAndrew Fuerste-Henry <andrew@bywatersolutions.com>
Wed, 26 Jan 2022 20:01:17 +0000 (20:01 +0000)
commit9cfe32aaad5652d420ce83fb328338afaca0df11
tree199a69378033bfaaca9da907aca94fb72df8e0e0
parent59238c74308f2d12b15099ad49b210befe2c6076
Bug 29541: Prevent users from another group to access patron's images

We should respect group restrictions here.

Test plan:
Create a patron from another group of libraries and don't let them
access info from patrons outside of this group.
Access the following link and confirm that you can see the image only
for patrons from their group
  /cgi-bin/koha/members/patronimage.pl?borrowernumber=XX

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 09cb5e02e6fad7b0dd3137d925646d714444a704)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
members/patronimage.pl