Bug 20031 - CGI param in list context warn in guided_reports.pl
Summary: CGI param in list context warn in guided_reports.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low trivial (vote)
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords: Academy
Depends on:
Blocks:
 
Reported: 2018-01-18 14:40 UTC by Marcel de Rooy
Modified: 2019-10-14 19:56 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 20031: CGI param in list context warn in guided_reports.pl (1.42 KB, patch)
2018-01-18 14:44 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2018-01-18 14:40:04 UTC

    
Comment 1 Marcel de Rooy 2018-01-18 14:44:43 UTC
Created attachment 70692 [details] [review]
Bug 20031: CGI param in list context warn in guided_reports.pl

Resolve warn:
CGI::param called in list context from package CGI::Compile::ROOT::usr_share_koha_shadowclone_reports_guided_reports_2epl line 794, this can lead to vulnerabilities. [NOTE: line number from older Koha version.]

Test plan:
Looking at this change should convince you already. Another look at this
routine in C4/Output.pm would be bonus.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Jonathan Druart 2018-02-02 13:44:04 UTC
I was going to submit it
Comment 3 Jonathan Druart 2018-02-02 15:10:45 UTC
Pushed to master for 18.05
Comment 4 Nick Clemens 2018-02-16 02:29:20 UTC
Awesome work all, pushed to stable for 17.11.03