Attachment 62913 Details for Bug 7550 – Bug 7550: [QA Follow-up] Resolve param warning from sco-patron-image

[patch] Bug 7550: [QA Follow-up] Resolve param warning from sco-patron-image

Bug-7550-QA-Follow-up-Resolve-param-warning-from-s.patch (text/plain), 1.90 KB, created by Marcel de Rooy on 2017-05-01 12:29:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-05-01 12:29:25 UTC

Size: 1.90 KB

patch

obsolete

>From 68948771779ade0542e3b3da3418c2aceedcc407 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Mon, 1 May 2017 14:15:58 +0200
>Subject: [PATCH] Bug 7550: [QA Follow-up] Resolve param warning from
> sco-patron-image
>Content-Type: text/plain; charset=utf-8
>
>Resolve this warning:
>  CGI::param called in list context from package C4::Service line 212, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
>
>It comes from the require_params call in sco-patron-image.pl.
>
>Git grepping on require_params tells me this:
>  members/default_messageprefs.pl:my ($categorycode) = C4::Service->require_params('categorycode');
>  opac/sco/sco-patron-image.pl:my ($borrowernumber) = C4::Service->require_params('borrowernumber');
>  opac/sco/sco-patron-image.pl:my ($csrf_token) = C4::Service->require_params('csrf_token');
>  svc/cataloguing/metasearch:my ( $query_string, $servers ) = C4::Service->require_params( 'q', 'servers' );
>
>The only candidate for multi_param seems to be 'servers', but as we can see
>this variable is a scalar. Additional servers returned by require_params are
>lost. This should be solved on its own report.
>So, we can safely add scalar to the params call, resolve the warning and
>keep the same behavior.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> C4/Service.pm | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/C4/Service.pm b/C4/Service.pm
>index da1d1ee..fa95a61 100644
>--- a/C4/Service.pm
>+++ b/C4/Service.pm
>@@ -209,7 +209,7 @@ sub require_params {
> 
>     for my $param ( @params ) {
>         $class->return_error( 'params', "Missing '$param'" ) if ( !defined( $query->param( $param ) ) );
>-        push @values, $query->param( $param );
>+        push @values, scalar $query->param( $param ); # will we ever need multi_param here?
>     }
> 
>     return @values;
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 7550: 62271 | 62272 | 62289 | 62311 | 62400 | 62441 | 62912 | 62913