Bug 32457 - CGI::param called in list context from acqui/addorder.pl line 182
Summary: CGI::param called in list context from acqui/addorder.pl line 182
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low trivial
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-13 14:30 UTC by Marcel de Rooy
Modified: 2023-12-28 20:44 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.01,22.05.09, 21.11.16
Circulation function:

Attachments
Bug 32457: Fix CGI vulnerability in addorder.pl (929 bytes, patch)
2022-12-13 14:40 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Bug 32457: Fix CGI vulnerability in addorder.pl (946 bytes, patch)
2022-12-14 18:07 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2022-12-13 14:30:49 UTC 
Line 182 in 21.11 / Line 193 in current master

This case needs multi_param. Patch coming.
Comment 1 Marcel de Rooy 2022-12-13 14:40:50 UTC 
Created attachment 144554 [details] [review]
Bug 32457: Fix CGI vulnerability in addorder.pl

Test plan:
Go to acqui/addorder.pl.
Create two items.
Check if results still match your expectations.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2022-12-13 14:41:15 UTC 
Trivial oneliner: self SO
Comment 3 Marcel de Rooy 2022-12-13 15:00:30 UTC 
Side-note for QA: If you examine the actual html page constructed, you'll see that this script generates a lot of garbage (hidden inputs).
Comment 4 Tomás Cohen Arazi (tcohen) 2022-12-14 18:07:49 UTC 
Created attachment 144588 [details] [review]
Bug 32457: Fix CGI vulnerability in addorder.pl

Test plan:
Go to acqui/addorder.pl.
Create two items.
Check if results still match your expectations.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 5 Tomás Cohen Arazi (tcohen) 2022-12-15 00:40:13 UTC 
Pushed to master for 23.05.

Nice work everyone, thanks!
Comment 6 Martin Renvoize (ashimema) 2022-12-15 14:06:19 UTC 
Nice work everyone!

Pushed to 22.11.x for the next release
Comment 7 Lucas Gass (lukeg) 2023-01-19 23:13:27 UTC 
Backported to 22.05.x for upcoming 22.05.09
Comment 8 Arthur Suzuki 2023-01-26 10:31:39 UTC 
applied to 21.11.x for 21.11.16
Comment 9 Wainui Witika-Park 2023-03-15 01:31:52 UTC 
Not backported to 21.05.x