Bug 14467 - Security updates break some Koha plugins
Summary: Security updates break some Koha plugins
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Kyle M Hall
QA Contact: Testopia
URL:
Keywords:
Depends on: 14408
Blocks:
  Show dependency treegraph
 
Reported: 2015-06-26 16:16 UTC by Kyle M Hall
Modified: 2016-12-05 21:22 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 14467 - Security updates break some Koha plugins (1.96 KB, patch)
2015-06-26 16:18 UTC, Kyle M Hall
Details | Diff | Splinter Review
[SIGNED OFF] Bug 14467 - Security updates break some Koha plugins (2.02 KB, patch)
2015-07-01 02:02 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 14467 - Security updates break some Koha plugins (2.17 KB, patch)
2015-07-02 13:40 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14467 - Security updates break some Koha plugins (2.08 KB, patch)
2015-07-07 15:43 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 14467 - Security updates break some Koha plugins (1.52 KB, patch)
2015-07-07 15:44 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2015-06-26 16:16:00 UTC
The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin.
Comment 1 Kyle M Hall 2015-06-26 16:18:39 UTC Comment hidden (obsolete)
Comment 2 Kyle M Hall 2015-06-26 16:19:43 UTC
Note this patch requires a new module Cwd. I don't find any evidence that it has been packaged for Debian, however it is also marked as optional and only needed for the Plugins system.
Comment 3 Mark Tompsett 2015-06-26 17:56:58 UTC
(In reply to Kyle M Hall from comment #2)
> Note this patch requires a new module Cwd. I don't find any evidence that it
> has been packaged for Debian, however it is also marked as optional and only
> needed for the Plugins system.

It's been a core module since at least Perl 5.8.8 as far as I can tell.
http://perldoc.perl.org/5.8.8/index-modules-C.html
Comment 4 Katrin Fischer 2015-06-28 18:57:34 UTC
Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set of patches - could this be the reason for the plugin problems? (see bug 14408 and the branches on git for the reverts/changes)
Comment 5 Kyle M Hall 2015-06-29 11:12:53 UTC
(In reply to M. Tompsett from comment #3)
> (In reply to Kyle M Hall from comment #2)
> > Note this patch requires a new module Cwd. I don't find any evidence that it
> > has been packaged for Debian, however it is also marked as optional and only
> > needed for the Plugins system.
> 
> It's been a core module since at least Perl 5.8.8 as far as I can tell.
> http://perldoc.perl.org/5.8.8/index-modules-C.html

Thanks! I was just about to post that. I thought it quite odd that it had no package yet a submodule for it did!
Comment 6 Kyle M Hall 2015-06-29 11:15:47 UTC
(In reply to Katrin Fischer from comment #4)
> Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set
> of patches - could this be the reason for the plugin problems? (see bug
> 14408 and the branches on git for the reverts/changes)

I don't think this. I believe this is directly caused by the new check for previous directory ( i.e. ".." ) in file paths. The problem is Module::Bundled::Files creates patches using .. in it, and thus it fails that test. Cwd takes that weird path and converts it to a safe path.
Comment 7 Kyle M Hall 2015-06-29 11:16:49 UTC
s/patches/paths
Comment 8 Nick Clemens 2015-07-01 02:02:54 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-07-02 12:13:58 UTC
Sorry, there is something wrong in my configuration, I don't manage to test plugins (always got a 403).
I am wondering if it's useful to put Cwd in the deps list, it's part of the Perl core modules.
Comment 10 Jonathan Druart 2015-07-02 13:40:19 UTC Comment hidden (obsolete)
Comment 11 Kyle M Hall 2015-07-07 15:43:46 UTC Comment hidden (obsolete)
Comment 12 Kyle M Hall 2015-07-07 15:44:19 UTC
Created attachment 40826 [details] [review]
Bug 14467 - Security updates break some Koha plugins

The new security updates break previously functioning plugins, most
notably the cover flow plugin and the Ebsco EDS plugin.

Test Plan:
1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ )
2) Note that attempting to access coverflow.pl from the OPAC results in an error
3) Apply this patch
4) Note that coverflow.pl now output html again

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Comment 13 Tomás Cohen Arazi 2015-07-07 18:28:45 UTC
Patch pushed to master.

Thanks Kyle!

Thanks for amending it.
Comment 14 Chris Cormack 2015-07-13 23:26:09 UTC
Pushed to 3.20.x will be in 3.20.2
Comment 15 Liz Rea 2015-07-20 22:14:13 UTC
Pushed to 3.18.x will be in 3.18.09
Comment 16 Mason James 2015-07-25 13:03:15 UTC
Pushed to 3.16.x, will be in 3.16.13