Bug 16969 - Vulnerability warning for opac/opac-memberentry.pl
Summary: Vulnerability warning for opac/opac-memberentry.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor
Assignee: Owen Leonard
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-24 05:50 UTC by Marc Véron
Modified: 2017-12-07 22:15 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 16969 cgi->param used in list context in opac-memberentry.pl (958 bytes, patch)
2016-07-24 07:20 UTC, Chris Cormack 		Details | Diff | Splinter Review
Bug 16969 cgi->param used in list context in opac-memberentry.pl (1.04 KB, patch)
2016-07-24 13:49 UTC, Marc Véron 		Details | Diff | Splinter Review
Bug 16969 cgi->param used in list context in opac-memberentry.pl (1.14 KB, patch)
2016-07-24 14:16 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Véron 2016-07-24 05:50:20 UTC 
From plack-error.log:

CGI::param called in list context from package CGI::Compile::ROOT::home_marc_koha_opac_opac_2dmemberentry_2epl line 362, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Chris Cormack 2016-07-24 07:20:51 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2016-07-24 13:49:20 UTC Comment hidden (obsolete)
Comment 3 Marcel de Rooy 2016-07-24 14:16:35 UTC 
Created attachment 53669 [details] [review]
Bug 16969 cgi->param used in list context in opac-memberentry.pl

To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works

Works as expected. (Note: See Bug 16960 for updating patron details).
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Kyle M Hall (khall) 2016-08-10 14:02:42 UTC 
Rebased and pushed to master for 16.11, thanks Chris!
Comment 5 Frédéric Demians 2016-08-23 10:00:11 UTC 
Pushed in 16.05. Will be in 16.05.03.
Comment 6 Julian Maurice 2016-08-24 09:02:09 UTC 
Pushed to 3.22.x, will be in 3.22.10
Comment 7 Chris Cormack 2016-08-31 09:22:34 UTC 
Pushed to 3.20.x will be in 3.20.15