Attachment 155499 Details for Bug 16514 – Bug 16514: Force scalar context reading cgi variables

[patch] Bug 16514: Force scalar context reading cgi variables

Bug-16514-Force-scalar-context-reading-cgi-variabl.patch (text/plain), 3.36 KB, created by Martin Renvoize (ashimema) on 2023-09-11 15:44:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2023-09-11 15:44:55 UTC

Size: 3.36 KB

patch

obsolete

>From 8a24dbf7d7d56b083a715ccc7be0eded04d2632f Mon Sep 17 00:00:00 2001
>From: Colin Campbell <colin.campbell@ptfs-europe.com>
>Date: Fri, 13 May 2016 15:45:09 +0100
>Subject: [PATCH] Bug 16514: Force scalar context reading cgi variables
>
>CGI's param method will default to returning in list context
>if it cant determine context from the lvalue
>This generates log warnings in newer versions of CGI that support
>multi_param. Force scalar context in the places where param
>can't ascertain its context correctly
>
>Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
>Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
>in list context from package main line 105, this can lead to
>vulnerabilities. See the warning in "Fetching the value or values of a
>single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
>http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
>---
> admin/edi_accounts.pl | 18 +++++++++---------
> 1 file changed, 9 insertions(+), 9 deletions(-)
>
>diff --git a/admin/edi_accounts.pl b/admin/edi_accounts.pl
>index 65e3b4e1a2..2d9ff2ebc3 100755
>--- a/admin/edi_accounts.pl
>+++ b/admin/edi_accounts.pl
>@@ -1,6 +1,7 @@
> #!/usr/bin/perl
> 
> # Copyright 2011,2014 Mark Gavillet & PTFS Europe Ltd
>+# Copyright 2016 PTFS Europe Ltd
> #
> # This file is part of Koha.
> #
>@@ -78,18 +79,18 @@ else {
>             description        => scalar $input->param('description'),
>             host               => scalar $input->param('host'),
>             username           => scalar $input->param('username'),
>-            password           => $password,
>+            password           => scalar $input->param('password'),
>             vendor_id          => scalar $input->param('vendor_id'),
>             upload_directory   => scalar $input->param('upload_directory'),
>             download_directory => scalar $input->param('download_directory'),
>             san                => scalar $input->param('san'),
>             standard           => scalar $input->param('standard'),
>             transport          => scalar $input->param('transport'),
>-            quotes_enabled     => $input->param('quotes_enabled') ? 1 : 0,
>-            invoices_enabled   => $input->param('invoices_enabled') ? 1 : 0,
>-            orders_enabled     => $input->param('orders_enabled') ? 1 : 0,
>-            responses_enabled  => $input->param('responses_enabled') ? 1 : 0,
>-            auto_orders        => $input->param('auto_orders') ? 1 : 0,
>+            quotes_enabled     => defined $input->param('quotes_enabled'),
>+            invoices_enabled   => defined $input->param('invoices_enabled'),
>+            orders_enabled     => defined $input->param('orders_enabled'),
>+            responses_enabled  => defined $input->param('responses_enabled'),
>+            auto_orders        => defined $input->param('auto_orders'),
>             id_code_qualifier  => scalar $input->param('id_code_qualifier'),
>             plugin             => scalar $input->param('plugin'),
>         };
>@@ -106,9 +107,8 @@ else {
>         }
>     }
>     elsif ( $op eq 'delete_confirmed' ) {
>-
>-        $schema->resultset('VendorEdiAccount')
>-          ->search( { id => scalar $input->param('id'), } )->delete_all;
>+        my $id = $input->param('id');
>+        $schema->resultset('VendorEdiAccount')->search( { id => $id } )->delete_all;
>     }
> 
>     # we do a default dispaly after deletes and saves
>-- 
>2.41.0

Actions: View | Diff | Splinter Review

Attachments on bug 16514: 51475 | 54965 | 155499 | 155500