Bug 32457 - CGI::param called in list context from acqui/addorder.pl line 182
Summary: CGI::param called in list context from acqui/addorder.pl line 182
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low trivial (vote)
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-13 14:30 UTC by Marcel de Rooy
Modified: 2023-12-28 20:44 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.01,22.05.09, 21.11.16


Attachments
Bug 32457: Fix CGI vulnerability in addorder.pl (929 bytes, patch)
2022-12-13 14:40 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 32457: Fix CGI vulnerability in addorder.pl (946 bytes, patch)
2022-12-14 18:07 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2022-12-13 14:30:49 UTC
Line 182 in 21.11 / Line 193 in current master

This case needs multi_param. Patch coming.
Comment 1 Marcel de Rooy 2022-12-13 14:40:50 UTC
Created attachment 144554 [details] [review]
Bug 32457: Fix CGI vulnerability in addorder.pl

Test plan:
Go to acqui/addorder.pl.
Create two items.
Check if results still match your expectations.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2022-12-13 14:41:15 UTC
Trivial oneliner: self SO
Comment 3 Marcel de Rooy 2022-12-13 15:00:30 UTC
Side-note for QA: If you examine the actual html page constructed, you'll see that this script generates a lot of garbage (hidden inputs).
Comment 4 Tomás Cohen Arazi 2022-12-14 18:07:49 UTC
Created attachment 144588 [details] [review]
Bug 32457: Fix CGI vulnerability in addorder.pl

Test plan:
Go to acqui/addorder.pl.
Create two items.
Check if results still match your expectations.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 5 Tomás Cohen Arazi 2022-12-15 00:40:13 UTC
Pushed to master for 23.05.

Nice work everyone, thanks!
Comment 6 Martin Renvoize 2022-12-15 14:06:19 UTC
Nice work everyone!

Pushed to 22.11.x for the next release
Comment 7 Lucas Gass 2023-01-19 23:13:27 UTC
Backported to 22.05.x for upcoming 22.05.09
Comment 8 Arthur Suzuki 2023-01-26 10:31:39 UTC
applied to 21.11.x for 21.11.16
Comment 9 wainuiwitikapark 2023-03-15 01:31:52 UTC
Not backported to 21.05.x