Bug 20031 - CGI param in list context warn in guided_reports.pl
Summary: CGI param in list context warn in guided_reports.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low trivial
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords: Academy
Depends on:
Blocks:
 
Reported: 2018-01-18 14:40 UTC by Marcel de Rooy
Modified: 2019-10-14 19:56 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 20031: CGI param in list context warn in guided_reports.pl (1.42 KB, patch)
2018-01-18 14:44 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2018-01-18 14:40:04 UTC 

    


    


      



        
          Comment 1
        

        
          Marcel de Rooy

        

        
        

        
          2018-01-18 14:44:43 UTC
        

      






Created attachment 70692 [details] [review]
Bug 20031: CGI param in list context warn in guided_reports.pl

Resolve warn:
CGI::param called in list context from package CGI::Compile::ROOT::usr_share_koha_shadowclone_reports_guided_reports_2epl line 794, this can lead to vulnerabilities. [NOTE: line number from older Koha version.]

Test plan:
Looking at this change should convince you already. Another look at this
routine in C4/Output.pm would be bonus.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

    


    


      



        
          Comment 2
        

        
          Jonathan Druart

        

        
        

        
          2018-02-02 13:44:04 UTC
        

      






I was going to submit it

    


    


      



        
          Comment 3
        

        
          Jonathan Druart

        

        
        

        
          2018-02-02 15:10:45 UTC
        

      






Pushed to master for 18.05

    


    


      



        
          Comment 4
        

        
          Nick Clemens (kidclamp)

        

        
        

        
          2018-02-16 02:29:20 UTC
        

      






Awesome work all, pushed to stable for 17.11.03