Bugzilla – Attachment 54965 Details for
Bug 16514
Force scalar context where param assumes a list incorrectly in admin/edi scripts
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables
SIGNED-OFF-Bug-16514-Force-scalar-context-reading-.patch (text/plain), 5.49 KB, created by
Aleisha Amohia
on 2016-08-29 04:31:24 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables
Filename:
MIME Type:
Creator:
Aleisha Amohia
Created:
2016-08-29 04:31:24 UTC
Size:
5.49 KB
patch
obsolete
>From ba1de2a5e8ddd4ba032aa6a0a120929f2699311e Mon Sep 17 00:00:00 2001 >From: Colin Campbell <colin.campbell@ptfs-europe.com> >Date: Fri, 13 May 2016 15:45:09 +0100 >Subject: [PATCH] [SIGNED-OFF] Bug 16514: Force scalar context reading cgi > variables > >CGI's param method will default to returning in list context >if it cant determine context from the lvalue >This generates log warnings in newer versions of CGI that support >multi_param. Force scalar context in the places where param >can't ascertain its context correctly > >Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> >Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called >in list context from package main line 105, this can lead to >vulnerabilities. See the warning in "Fetching the value or values of a >single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: >http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2" >--- > admin/edi_accounts.pl | 27 ++++++++++++++------------- > admin/edi_ean_accounts.pl | 20 +++++++++++--------- > 2 files changed, 25 insertions(+), 22 deletions(-) > >diff --git a/admin/edi_accounts.pl b/admin/edi_accounts.pl >index 5f963bd..05a5fce 100755 >--- a/admin/edi_accounts.pl >+++ b/admin/edi_accounts.pl >@@ -1,6 +1,7 @@ > #!/usr/bin/perl > > # Copyright 2011,2014 Mark Gavillet & PTFS Europe Ltd >+# Copyright 2016 PTFS Europe Ltd > # > # This file is part of Koha. > # >@@ -71,22 +72,22 @@ else { > # validate & display > my $id = $input->param('id'); > my $fields = { >- description => $input->param('description'), >- host => $input->param('host'), >- username => $input->param('username'), >- password => $input->param('password'), >- vendor_id => $input->param('vendor_id'), >- upload_directory => $input->param('upload_directory'), >- download_directory => $input->param('download_directory'), >- san => $input->param('san'), >- transport => $input->param('transport'), >+ description => scalar $input->param('description'), >+ host => scalar $input->param('host'), >+ username => scalar $input->param('username'), >+ password => scalar $input->param('password'), >+ vendor_id => scalar $input->param('vendor_id'), >+ upload_directory => scalar $input->param('upload_directory'), >+ download_directory => scalar $input->param('download_directory'), >+ san => scalar $input->param('san'), >+ transport => scalar $input->param('transport'), > quotes_enabled => defined $input->param('quotes_enabled'), > invoices_enabled => defined $input->param('invoices_enabled'), > orders_enabled => defined $input->param('orders_enabled'), > responses_enabled => defined $input->param('responses_enabled'), > auto_orders => defined $input->param('auto_orders'), >- id_code_qualifier => $input->param('id_code_qualifier'), >- plugin => $input->param('plugin'), >+ id_code_qualifier => scalar $input->param('id_code_qualifier'), >+ plugin => scalar $input->param('plugin'), > }; > > if ($id) { >@@ -101,9 +102,9 @@ else { > } > } > elsif ( $op eq 'delete_confirmed' ) { >- >+ my $id = $input->param('id'); > $schema->resultset('VendorEdiAccount') >- ->search( { id => $input->param('id'), } )->delete_all; >+ ->search( { id => $id, } )->delete_all; > } > > # we do a default dispaly after deletes and saves >diff --git a/admin/edi_ean_accounts.pl b/admin/edi_ean_accounts.pl >index f65ab9e..62cddca 100755 >--- a/admin/edi_ean_accounts.pl >+++ b/admin/edi_ean_accounts.pl >@@ -1,6 +1,7 @@ > #!/usr/bin/perl > > # Copyright 2012, 2014 Mark Gavillet & PTFS Europe Ltd >+# Copyright 2016 PTFS Europe Ltd > # > # This file is part of Koha. > # >@@ -113,10 +114,10 @@ sub addsubmit { > > my $new_ean = $schema->resultset('EdifactEan')->new( > { >- branchcode => $input->param('branchcode'), >- description => $input->param('description'), >- ean => $input->param('ean'), >- id_code_qualifier => $input->param('id_code_qualifier'), >+ branchcode => scalar $input->param('branchcode'), >+ description => scalar $input->param('description'), >+ ean => scalar $input->param('ean'), >+ id_code_qualifier => scalar $input->param('id_code_qualifier'), > } > ); > $new_ean->insert(); >@@ -124,12 +125,13 @@ sub addsubmit { > } > > sub editsubmit { >- $schema->resultset('EdifactEan')->find( $input->param('id') )->update( >+ my $id = $input->param('id'); >+ $schema->resultset('EdifactEan')->find( $id )->update( > { >- branchcode => $input->param('branchcode'), >- description => $input->param('description'), >- ean => $input->param('ean'), >- id_code_qualifier => $input->param('id_code_qualifier'), >+ branchcode => scalar $input->param('branchcode'), >+ description => scalar $input->param('description'), >+ ean => scalar $input->param('ean'), >+ id_code_qualifier => scalar $input->param('id_code_qualifier'), > } > ); > return; >-- >2.1.4
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=54965">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16514
:
51475
|
54965
|
155499
|
155500