Attachment 66866 Details for Bug 19258 – Bug 19258: Preventing warns when paying a fine or charge from Pay selected button

[patch] Bug 19258: Preventing warns when paying a fine or charge from Pay selected button

Bug-19258-Preventing-warns-when-paying-a-fine-or-c.patch (text/plain), 2.10 KB, created by Mark Tompsett on 2017-09-06 04:29:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Tompsett

Created: 2017-09-06 04:29:23 UTC

Size: 2.10 KB

patch

obsolete

>From 8f89ad2337a48ffba37893d44a3604def12184af Mon Sep 17 00:00:00 2001
>From: Aleisha Amohia <aleishaamohia@hotmail.com>
>Date: Tue, 5 Sep 2017 22:38:12 +0000
>Subject: [PATCH] Bug 19258: Preventing warns when paying a fine or charge from
> Pay selected button
>
>The following warns are triggered when I click the Pay selected button:
>CGI::param called in list context from package
>CGI::Compile::ROOT::home_vagrant_kohaclone_members_pay_2epl line 267,
>this can lead to vulnerabilities. See the warning in "Fetching the
>value or values of a single named parameter" at
>usr/share/perl5/CGI.pm line 436.
>CGI::param called in list context from package
>CGI::Compile::ROOT::home_vagrant_kohaclone_members_pay_2epl line
>273, this can lead to vulnerabilities. See the warning in "Fetching
>the value or values of a single named parameter" at
>/usr/share/perl5/CGI.pm line 436.
>
>To test:
>1) Go to a members detail page in staff side and create a manual
>invoice
>2) Go to the pay fines tab, select the fine you just created and click
>Pay selected
>3) Notice warns
>4) Apply patch and repeat steps 1 & 2
>5) Warns should be gone
>
>Sponsored-by: Catalyst IT
>
>Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
>---
> members/pay.pl | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/members/pay.pl b/members/pay.pl
>index 5da2c41..70e45e2 100755
>--- a/members/pay.pl
>+++ b/members/pay.pl
>@@ -264,13 +264,13 @@ sub payselected {
>     foreach (@params) {
>         if (/^incl_par_(\d+)$/) {
>             my $index = $1;
>-            push @lines_to_pay, $input->param("accountlines_id$index");
>+            push @lines_to_pay, scalar $input->param("accountlines_id$index");
>             $amt += $input->param("amountoutstanding$index");
>         }
>     }
>     $amt = '&amt=' . $amt;
>     my $sel = '&selected=' . join ',', @lines_to_pay;
>-    my $notes = '&notes=' . join("%0A", map { $input->param("payment_note_$_") } @lines_to_pay );
>+    my $notes = '&notes=' . join("%0A", map { scalar $input->param("payment_note_$_") } @lines_to_pay );
>     my $redirect =
>         "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber"
>       . $amt
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19258: 66859 | 66860 | 66861 | 66862 | 66864 | 66865 | 66866 | 66867 | 66958 | 66959 | 66960 | 66961