Bug 19112 - Stored XSS in basketheader.pl page

[koha.git] / members / notices.pl

diff --git a/members/notices.pl b/members/notices.pl
index 962a3f1..9f0ab11 100755 (executable)
--- a/members/notices.pl
+++ b/members/notices.pl
@@ -27,14 +27,18 @@ use CGI qw ( -utf8 );
 use C4::Members;
 use C4::Letters;
 use C4::Members::Attributes qw(GetBorrowerAttributes);
-use Koha::Patron::Images;
+use Koha::Patrons;
 
 my $input=new CGI;
 
 
 my $borrowernumber = $input->param('borrowernumber');
-#get borrower details
-my $borrower = GetMember(borrowernumber => $borrowernumber);
+my $patron = Koha::Patrons->find( $borrowernumber );
+unless ( $patron ) {
+    print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
+    exit;
+}
+my $borrower = $patron->unblessed;
 
 my ($template, $loggedinuser, $cookie)
 = get_template_and_user({template_name => "members/notices.tt",
@@ -46,8 +50,7 @@ my ($template, $loggedinuser, $cookie)
                                });
 
 $template->param( $borrower );
-my $patron_image = Koha::Patron::Images->find($borrower->{borrowernumber});
-$template->param( picture => 1 ) if $patron_image;
+$template->param( picture => 1 ) if $patron->image;
 
 # Allow resending of messages in Notices tab
 my $op = $input->param('op') || q{};
@@ -73,12 +76,12 @@ if (C4::Context->preference('ExtendedPatronAttributes')) {
 }
 
 $template->param(%$borrower);
-
+$template->param( adultborrower => 1 ) if ( $borrower->{category_type} eq 'A' || $borrower->{category_type} eq 'I' );
 $template->param(
     QUEUED_MESSAGES    => $queued_messages,
     borrowernumber     => $borrowernumber,
     sentnotices        => 1,
-    categoryname       => $borrower->{'description'},
+    categoryname       => $patron->category->description,
     RoutingSerials => C4::Context->preference('RoutingSerials'),
 );
 output_html_with_http_headers $input, $cookie, $template->output;