gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 34478: Fix sco-patron-image.pl access control regression 

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
David Cook 2024-02-20 23:06:08 +00:00 committed by Jonathan Druart
parent 7dc1b9e954
commit 3f9b523bc5
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
View File

@ -295,7 +295,7 @@
</div> <!-- / .span12/12 -->
[% IF ( display_patron_image ) %]
<div class="col-lg-2">
<img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber | uri %]" alt="" />
<img src="/cgi-bin/koha/sco/sco-patron-image.pl" alt="" />
</div>
[% END %]
</div> <!-- / .row -->

12
opac/sco/sco-patron-image.pl
View File

@ -40,10 +40,16 @@ unless ( in_iprange(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
exit;
}
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
my $jwt = $query->cookie('JWT');
my $patron = Koha::Patrons->find( $borrowernumber );
my $patron_image = $patron->image;
#NOTE: This should be borrowernumber and not cardnumber, but that's a deeper problem with patron images...
my $cardnumber = $jwt ? Koha::Token->new->decode_jwt( { token => $jwt } ) : undef;
my $patron = Koha::Patrons->find( { cardnumber => $cardnumber } );
my $patron_image;
if ($patron) {
$patron_image = $patron->image;
}
if ($patron_image) {