Bugzilla – Attachment 66959 Details for
Bug 19258
Fix warns when paying or writing off a fine or charge
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19258: Prevent warns when writing off an individual fine
Bug-19258-Prevent-warns-when-writing-off-an-indivi.patch (text/plain), 2.35 KB, created by
Jonathan Druart
on 2017-09-07 17:41:07 UTC
(
hide
)
Description:
Bug 19258: Prevent warns when writing off an individual fine
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2017-09-07 17:41:07 UTC
Size:
2.35 KB
patch
obsolete
>From e092f571bb39b72ea71d0724e752fa03a5f2901b Mon Sep 17 00:00:00 2001 >From: Aleisha Amohia <aleishaamohia@hotmail.com> >Date: Tue, 5 Sep 2017 22:34:18 +0000 >Subject: [PATCH] Bug 19258: Prevent warns when writing off an individual fine > >The following warns are triggered when I click the Write Off button next >to an individual fine or charge: >CGI::param called in list context from package >CGI::Compile::ROOT::home_vagrant_kohaclone_members_pay_2epl line 171, >this can lead to vulnerabilities. See the warning in "Fetching the >value or values of a single named parameter" at >/usr/share/perl5/CGI.pm line 436. (this shows many times) >Use of uninitialized value in subroutine entry at >/usr/share/perl5/URI/Escape.pm line 184. > >To test: >1) Go to a members detail page in staff side and create a manual >invoice >2) Go to the pay fines tab, click the Write off button next to the >invoice you just created >3) Notice warns >4) Apply patch and repeat steps 1 & 2 >5) Warns should be gone > >Sponsored-by: Catalyst IT > >Signed-off-by: Mark Tompsett <mtompset@hotmail.com> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > members/pay.pl | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > >diff --git a/members/pay.pl b/members/pay.pl >index 7c3f6ad8ae..5da2c411a6 100755 >--- a/members/pay.pl >+++ b/members/pay.pl >@@ -168,7 +168,10 @@ sub add_accounts_to_template { > sub get_for_redirect { > my ( $name, $name_in, $money ) = @_; > my $s = q{&} . $name . q{=}; >- my $value = uri_escape_utf8( $input->param($name_in) ); >+ my $value; >+ if (defined $input->param($name_in)) { >+ $value = uri_escape_utf8( scalar $input->param($name_in) ); >+ } > if ( !defined $value ) { > $value = ( $money == 1 ) ? 0 : q{}; > } >@@ -196,7 +199,7 @@ sub redirect_to_paycollect { > $redirect .= get_for_redirect( 'notify_id', "notify_id$line_no", 0 ); > $redirect .= get_for_redirect( 'notify_level', "notify_level$line_no", 0 ); > $redirect .= get_for_redirect( 'accountlines_id', "accountlines_id$line_no", 0 ); >- $redirect .= q{&} . 'payment_note' . q{=} . uri_escape_utf8( $input->param("payment_note_$line_no") ); >+ $redirect .= q{&} . 'payment_note' . q{=} . uri_escape_utf8( scalar $input->param("payment_note_$line_no") ); > $redirect .= '&remote_user='; > $redirect .= $user; > return print $input->redirect($redirect); >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19258
:
66859
|
66860
|
66861
|
66862
|
66864
|
66865
|
66866
|
66867
|
66958
| 66959 |
66960
|
66961