Bugzilla – Attachment 47964 Details for
Bug 15809
versions of CGI < 4.08 do not have multi_param
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 15809: Redefine multi_param is CGI < 4.08 is used
Bug-15809-Redefine-multiparam-is-CGI--408-is-used.patch (text/plain), 1.85 KB, created by
Jonathan Druart
on 2016-02-12 11:35:44 UTC
(
hide
)
Description:
Bug 15809: Redefine multi_param is CGI < 4.08 is used
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2016-02-12 11:35:44 UTC
Size:
1.85 KB
patch
obsolete
>From adcb64a6196f90ff421ac7c28ed36f470e8c4de0 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 12 Feb 2016 11:32:02 +0000 >Subject: [PATCH] Bug 15809: Redefine multi_param is CGI < 4.08 is used > >On debian Jessie, the CGI version is >= 4.08 >Since this version, the param method raise a warning >"CGI::param called in list context". >Indeed, it can cause vulnerability if called in list context > >https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter >http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/ > >There is a long journey to get rid of these warnings. >First I suggest to redefine the multi_param method when the CGI version > installed is < 4.08, it will allow us to move the wrong ->param calls to > ->multi_param without waiting for everybody to upgrade. > >The different ways to call these 2 methods are: > >my $foo = $cgi->param('foo'); # OK > >my @foo = $cgi->param('foo'); # NOK, will raise the warning >my @foo = $cgi->multi_param('foo'); #OK > >$template->param( foo => $cgi->param('foo') ); # NOK, will raise the warning > # and vulnerable >$template->param( foo => scalar $cgi->param('foo') ); # OK >--- > C4/Context.pm | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/C4/Context.pm b/C4/Context.pm >index 341438a..61f0973 100644 >--- a/C4/Context.pm >+++ b/C4/Context.pm >@@ -76,6 +76,12 @@ BEGIN { > if ($ENV{KOHA_BACKTRACES}) { > $main::SIG{__DIE__} = \&CGI::Carp::confess; > } >+ if (!defined($CGI::VERSION) || $CGI::VERSION < 4.08) { >+ no warnings 'redefine'; >+ *CGI::multi_param = \&CGI::param; >+ use warnings 'redefine'; >+ $CGI::LIST_CONTEXT_WARN = 0; >+ } > } # else there is no browser to send fatals to! > > # Check if there are memcached servers set >-- >2.7.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 15809
:
47964
|
47965
|
48046
|
49300