Bug 18320 - patroncards/edit-layout.pl raises warnings
Summary: patroncards/edit-layout.pl raises warnings
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Tomás Cohen Arazi
QA Contact: Testopia
URL:
Keywords:
: 21051 (view as bug list)
Depends on: 8603
Blocks: 29771
  Show dependency treegraph
 
Reported: 2017-03-23 12:50 UTC by Tomás Cohen Arazi
Modified: 2022-12-12 21:24 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.03,21.05.11


Attachments
Bug 18320: Remove patroncards/edit-layout.pl warnings (2.43 KB, patch)
2017-03-23 12:53 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 18320: Remove patroncards/edit-layout.pl warnings (2.53 KB, patch)
2019-01-25 11:11 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 18320: Remove patroncards/edit-layout.pl warnings (2.49 KB, patch)
2021-12-23 20:56 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 18320: Remove calls to CGI->param from the templates in patron cards (5.44 KB, patch)
2021-12-23 20:56 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 18320: Remove patroncards/edit-layout.pl warnings (2.56 KB, patch)
2022-01-07 15:55 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 18320: Remove calls to CGI->param from the templates in patron cards (5.52 KB, patch)
2022-01-07 15:55 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2017-03-23 12:50:31 UTC
Steps to reproduce:
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> FAIL: Warnings logged by edit-layout.pl
Comment 1 Tomás Cohen Arazi 2017-03-23 12:53:11 UTC
Created attachment 61532 [details] [review]
Bug 18320: Remove patroncards/edit-layout.pl warnings

This patch removes warnings generated by the script itself.

To test:
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> FAIL: Warnings logged by edit-layout.pl
- Apply this patch
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> SUCCESS: No warnings generated by edit-layout.pl
- Sign off :-D
Comment 2 Marc Véron 2017-03-23 20:36:49 UTC
Without patch, I get 2 warnings (in Plack error log), while saving a layout:

CGI::param called in list context from package CGI::Compile::ROOT::home_marc_koha_patroncards_edit_2dlayout_2epl line 186, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.

CGI::param called in list context from package Template::Provider line 47, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.


With patch (+ Plack restarted), I get the second warning only:
CGI::param called in list context from package Template::Provider line 47, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 3 Owen Leonard 2017-05-09 16:09:17 UTC
I'm assuming based on Comment 2 that this should be 'Failed QA'
Comment 4 Tomás Cohen Arazi 2019-01-03 14:05:15 UTC
The remaining warning comes from manage.pl. Taking care of it
Comment 5 Marcel de Rooy 2019-01-25 11:11:06 UTC
Created attachment 84403 [details] [review]
Bug 18320: Remove patroncards/edit-layout.pl warnings

This patch removes warnings generated by the script itself.

To test:
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> FAIL: Warnings logged by edit-layout.pl
- Apply this patch
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> SUCCESS: No warnings generated by edit-layout.pl
- Sign off :-D

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Katrin Fischer 2019-02-03 11:44:01 UTC
I still see one:


1) Add a new patron layout, just entering the layout name
2) Change the Units
CGI::param called in list context from /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc line 57, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412.
3) Delete layout
CGI::param called in list context from /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc line 57, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412.

I don't seem to be able to make them appear consistently. Can you take a look?

(Marking failed QA, to get your attention ;) )
Comment 7 Tomás Cohen Arazi 2021-12-23 20:56:09 UTC
(In reply to Katrin Fischer from comment #6)
> I still see one:
> 
> 
> 1) Add a new patron layout, just entering the layout name
> 2) Change the Units
> CGI::param called in list context from
> /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-
> errors.inc line 57, this can lead to vulnerabilities. See the warning in
> "Fetching the value or values of a single named parameter" at
> /usr/share/perl5/CGI.pm line 412.
> 3) Delete layout
> CGI::param called in list context from
> /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-
> errors.inc line 57, this can lead to vulnerabilities. See the warning in
> "Fetching the value or values of a single named parameter" at
> /usr/share/perl5/CGI.pm line 412.
> 
> I don't seem to be able to make them appear consistently. Can you take a
> look?
> 
> (Marking failed QA, to get your attention ;) )

Sorry for the delay. Will need your help testing it.
Comment 8 Tomás Cohen Arazi 2021-12-23 20:56:16 UTC
Created attachment 128911 [details] [review]
Bug 18320: Remove patroncards/edit-layout.pl warnings

This patch removes warnings generated by the script itself.

To test:
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> FAIL: Warnings logged by edit-layout.pl
- Apply this patch
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> SUCCESS: No warnings generated by edit-layout.pl
- Sign off :-D

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Tomás Cohen Arazi 2021-12-23 20:56:21 UTC
Created attachment 128912 [details] [review]
Bug 18320: Remove calls to CGI->param from the templates in patron cards

This patch removes calls to CGI->param from within the templates
(patroncards-errors.inc) and passes error_* variables with the same
codes from the controllers to the template instead.

This way we can be sure CGI->param is not called in list context.

To test, try those pages and see they don't show warnings anymore.
Verify that error situations still show the error messages.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 10 Jonathan Druart 2022-01-07 15:55:22 UTC
Created attachment 129193 [details] [review]
Bug 18320: Remove patroncards/edit-layout.pl warnings

This patch removes warnings generated by the script itself.

To test:
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> FAIL: Warnings logged by edit-layout.pl
- Apply this patch
- Go to Tools › Patron card creator › Manage layouts and
        Tools › Patron card creator › New layout
- Add a new layout, adit existing.
=> SUCCESS: No warnings generated by edit-layout.pl
- Sign off :-D

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 11 Jonathan Druart 2022-01-07 15:55:28 UTC
Created attachment 129194 [details] [review]
Bug 18320: Remove calls to CGI->param from the templates in patron cards

This patch removes calls to CGI->param from within the templates
(patroncards-errors.inc) and passes error_* variables with the same
codes from the controllers to the template instead.

This way we can be sure CGI->param is not called in list context.

To test, try those pages and see they don't show warnings anymore.
Verify that error situations still show the error messages.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 12 Jonathan Druart 2022-01-10 13:40:40 UTC
*** Bug 21051 has been marked as a duplicate of this bug. ***
Comment 13 Fridolin Somers 2022-01-19 22:16:13 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 14 Kyle M Hall 2022-02-07 11:36:48 UTC
Pushed to 21.11.x for 21.11.03
Comment 15 Andrew Fuerste-Henry 2022-02-16 17:41:57 UTC
Pushed to 21.05.x for 21.05.11
Comment 16 Victor Grousset/tuxayo 2022-02-21 08:51:40 UTC
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.