Bug 14076 - Noisy warns in opac-authorities-home.pl
Summary: Noisy warns in opac-authorities-home.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 15809
Blocks:
  Show dependency treegraph
 
Reported: 2015-04-29 05:22 UTC by Mark Tompsett
Modified: 2016-12-05 21:25 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 14076: silence warnings in opac/opac-authorities-home.pl (1.83 KB, patch)
2015-05-13 20:13 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl (1.76 KB, patch)
2016-02-12 11:53 UTC, Jonathan Druart
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl (1.83 KB, patch)
2016-02-15 06:52 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl (1.92 KB, patch)
2016-03-25 09:46 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Tompsett 2015-04-29 05:22:34 UTC
While testing bug 14075, I noticed other noisy errors in my log file.

Please look into conversion of the $query->param(...) stuff starting around line 62 into the use of $query->multi_param(...) equivalents.

[Wed Apr 29 01:03:03.943951 2015] [cgi:error] [pid 1930] [client 192.168.45.37:57137] AH01215: [Wed Apr 29 01:03:03 2015] opac-authorities-home.pl: CGI::param called in list context from package main line 62, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
[Wed Apr 29 01:03:03.944202 2015] [cgi:error] [pid 1930] [client 192.168.45.37:57137] AH01215: [Wed Apr 29 01:03:03 2015] opac-authorities-home.pl: CGI::param called in list context from package main line 63, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
[Wed Apr 29 01:03:03.944471 2015] [cgi:error] [pid 1930] [client 192.168.45.37:57137] AH01215: [Wed Apr 29 01:03:03 2015] opac-authorities-home.pl: CGI::param called in list context from package main line 64, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
[Wed Apr 29 01:03:03.944604 2015] [cgi:error] [pid 1930] [client 192.168.45.37:57137] AH01215: [Wed Apr 29 01:03:03 2015] opac-authorities-home.pl: CGI::param called in list context from package main line 65, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Mark Tompsett 2015-05-13 20:13:17 UTC Comment hidden (obsolete)
Comment 2 Bernardo Gonzalez Kriegel 2015-05-14 12:59:02 UTC
Marc, you still see those messages?
On current master (aa8bd7a Koha 3.20 beta) I see no messages at all
Comment 3 Mark Tompsett 2015-05-14 14:12:02 UTC
(In reply to Bernardo Gonzalez Kriegel from comment #2)
> Marc, you still see those messages?
> On current master (aa8bd7a Koha 3.20 beta) I see no messages at all

Greetings, I do. I should have also mentioned. This will require Apache 2.4.
Comment 4 Bernardo Gonzalez Kriegel 2015-05-14 14:14:08 UTC
(In reply to M. Tompsett from comment #3)
...
> Greetings, I do. I should have also mentioned. This will require Apache 2.4.

Ah! I have 2.2, will try in another machine
Comment 5 Bernardo Gonzalez Kriegel 2015-05-16 19:58:21 UTC
(In reply to Bernardo Gonzalez Kriegel from comment #4)
> (In reply to M. Tompsett from comment #3)
> ...
> > Greetings, I do. I should have also mentioned. This will require Apache 2.4.
> 
> Ah! I have 2.2, will try in another machine


Tried, Server version: Apache/2.4.7 (Ubuntu)
No warns
Comment 6 Mark Tompsett 2015-05-16 22:54:56 UTC
Test with a newer version of Perl. This was Perl 5.20.2 under Debian. CGI is a core module.
Comment 7 Blou 2015-06-23 20:36:41 UTC
This would need to be extended... extensively.  
This is not a Apache2.4 issue, as our client is still 2.2.  
This is not a Perl 5.20 issue, as our client is 5.14.2

I suspect this is a CGI.pm issue since we upgraded it.  Maybe?

Anyway: the logs are filled with this warning, for every conceivable source in the code:

CGI::param called in list context from /home/i/git/koha-ahuntsic-prod-ccsr/circ/circulation.pl line 110, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/local/share/perl/5.14.2/CGI.pm line 404

(same for lines 114,413,414, in Koha 3.18.04)

Other warners:
svc/checkouts line 46
svc/members/search line 33
additem.pl line 622
detail.pl line 364
C4/Biblio.pm line 2619

and so on...

See #13671 for similar issue (unrelated to the bug)
Comment 8 Mark Tompsett 2015-06-23 20:39:20 UTC
Yes, if you are running Debian Jessie, you will trigger this. :)
Comment 9 Fridolin Somers 2015-07-29 13:58:35 UTC
Arf looks like multi_param() method does not exist in Wheezy version of CGI.pm, only since Jessie.
Comment 10 Mark Tompsett 2015-07-29 19:10:58 UTC
(In reply to Fridolin SOMERS from comment #9)
> Arf looks like multi_param() method does not exist in Wheezy version of
> CGI.pm, only since Jessie.

How disappointing! I have confirmed with a fresh install of Debian 7.8 that only has CGI version 3.52, and multi_param is not introduced until CGI version 4.08, and Jessie has CGI version 4.09, which is why it is there.

Suggestions on a wheezy-friendly solution?
Comment 11 Jonathan Druart 2016-02-12 11:53:20 UTC Comment hidden (obsolete)
Comment 12 Mark Tompsett 2016-02-15 06:52:15 UTC Comment hidden (obsolete)
Comment 13 Marcel de Rooy 2016-03-25 09:46:34 UTC
Created attachment 49584 [details] [review]
Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl

See bug 15809 for more info on why we should not use CGI->param in list
context.

Note: I have not found any places where several values for the same
params are passed to this script but, just in case, this patch won't
change this ability.

Test plan:
Do an authority search at the OPAC
Test with several values of the form.
Confirm that the results are always the same before and after this
patch.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 14 Brendan Gallagher 2016-03-25 21:28:37 UTC
Pushed to Master - Should be in the May 2016 Release.  Thanks!
Comment 15 Julian Maurice 2016-04-08 05:43:17 UTC
Patch pushed to 3.22.x, will be in 3.22.6
Comment 16 Frédéric Demians 2016-04-27 15:35:09 UTC
Pushed to 3.22.x, will be in 3.20.11.