Bug 14467

Summary: Security updates break some Koha plugins
Product: Koha Reporter: Kyle M Hall <kyle>
Component: Architecture, internals, and plumbingAssignee: Kyle M Hall <kyle>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: abl, chris, jonathan.druart, katrin.fischer, liz, mtj, mtompset, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 14408    
Bug Blocks:    
Attachments: Bug 14467 - Security updates break some Koha plugins
[SIGNED OFF] Bug 14467 - Security updates break some Koha plugins
Bug 14467 - Security updates break some Koha plugins
Bug 14467 - Security updates break some Koha plugins
Bug 14467 - Security updates break some Koha plugins

Description Kyle M Hall 2015-06-26 16:16:00 UTC
The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin.
Comment 1 Kyle M Hall 2015-06-26 16:18:39 UTC Comment hidden (obsolete)
Comment 2 Kyle M Hall 2015-06-26 16:19:43 UTC
Note this patch requires a new module Cwd. I don't find any evidence that it has been packaged for Debian, however it is also marked as optional and only needed for the Plugins system.
Comment 3 Mark Tompsett 2015-06-26 17:56:58 UTC
(In reply to Kyle M Hall from comment #2)
> Note this patch requires a new module Cwd. I don't find any evidence that it
> has been packaged for Debian, however it is also marked as optional and only
> needed for the Plugins system.

It's been a core module since at least Perl 5.8.8 as far as I can tell.
http://perldoc.perl.org/5.8.8/index-modules-C.html
Comment 4 Katrin Fischer 2015-06-28 18:57:34 UTC
Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set of patches - could this be the reason for the plugin problems? (see bug 14408 and the branches on git for the reverts/changes)
Comment 5 Kyle M Hall 2015-06-29 11:12:53 UTC
(In reply to M. Tompsett from comment #3)
> (In reply to Kyle M Hall from comment #2)
> > Note this patch requires a new module Cwd. I don't find any evidence that it
> > has been packaged for Debian, however it is also marked as optional and only
> > needed for the Plugins system.
> 
> It's been a core module since at least Perl 5.8.8 as far as I can tell.
> http://perldoc.perl.org/5.8.8/index-modules-C.html

Thanks! I was just about to post that. I thought it quite odd that it had no package yet a submodule for it did!
Comment 6 Kyle M Hall 2015-06-29 11:15:47 UTC
(In reply to Katrin Fischer from comment #4)
> Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set
> of patches - could this be the reason for the plugin problems? (see bug
> 14408 and the branches on git for the reverts/changes)

I don't think this. I believe this is directly caused by the new check for previous directory ( i.e. ".." ) in file paths. The problem is Module::Bundled::Files creates patches using .. in it, and thus it fails that test. Cwd takes that weird path and converts it to a safe path.
Comment 7 Kyle M Hall 2015-06-29 11:16:49 UTC
s/patches/paths
Comment 8 Nick Clemens 2015-07-01 02:02:54 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-07-02 12:13:58 UTC
Sorry, there is something wrong in my configuration, I don't manage to test plugins (always got a 403).
I am wondering if it's useful to put Cwd in the deps list, it's part of the Perl core modules.
Comment 10 Jonathan Druart 2015-07-02 13:40:19 UTC Comment hidden (obsolete)
Comment 11 Kyle M Hall 2015-07-07 15:43:46 UTC Comment hidden (obsolete)
Comment 12 Kyle M Hall 2015-07-07 15:44:19 UTC
Created attachment 40826 [details] [review]
Bug 14467 - Security updates break some Koha plugins

The new security updates break previously functioning plugins, most
notably the cover flow plugin and the Ebsco EDS plugin.

Test Plan:
1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ )
2) Note that attempting to access coverflow.pl from the OPAC results in an error
3) Apply this patch
4) Note that coverflow.pl now output html again

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Comment 13 Tomás Cohen Arazi 2015-07-07 18:28:45 UTC
Patch pushed to master.

Thanks Kyle!

Thanks for amending it.
Comment 14 Chris Cormack 2015-07-13 23:26:09 UTC
Pushed to 3.20.x will be in 3.20.2
Comment 15 Liz Rea 2015-07-20 22:14:13 UTC
Pushed to 3.18.x will be in 3.18.09
Comment 16 Mason James 2015-07-25 13:03:15 UTC
Pushed to 3.16.x, will be in 3.16.13