Attachment 88996 Details for Bug 7862 – Bug 7862: Preventing warns when creating a notice

[patch] Bug 7862: Preventing warns when creating a notice

Bug-7862-Preventing-warns-when-creating-a-notice.patch (text/plain), 3.02 KB, created by Aleisha Amohia on 2019-04-29 03:18:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Aleisha Amohia

Created: 2019-04-29 03:18:30 UTC

Size: 3.02 KB

patch

obsolete

>From 8c68454ad28b753a1102e3c50742ec5555441488 Mon Sep 17 00:00:00 2001
>From: Aleisha Amohia <aleishaamohia@hotmail.com>
>Date: Mon, 29 Apr 2019 03:14:35 +0000
>Subject: [PATCH] Bug 7862: Preventing warns when creating a notice
>
>To reproduce warns:
>1) Go to Tools -> Notices & slips
>2) Create a new notice of any module
>
>Notice these warns:
>Use of uninitialized value $code in regexp compilation at
>/home/vagrant/kohaclone/tools/letter.pl line 265.
>Use of uninitialized value $code in regexp compilation at
>/home/vagrant/kohaclone/tools/letter.pl line 265.
>Use of uninitialized value $code in regexp compilation at
>/home/vagrant/kohaclone/tools/letter.pl line 265.
>
>CGI::param called in list context from package
>CGI::Compile::ROOT::home_vagrant_kohaclone_svc_letters_get line 50, this
>can lead to vulnerabilities. See the warning in "Fetching the value or
>values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
>CGI::param called in list context from package
>CGI::Compile::ROOT::home_vagrant_kohaclone_svc_letters_get line 50, this
>can lead to vulnerabilities. See the warning in "Fetching the value or
>values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
>
>3) Create a new notice of the Circulation module
>
>Notice this additional warn:
>Use of uninitialized value $code in pattern match (m//) at
>/home/vagrant/kohaclone/tools/letter.pl line 258.
>
>To test:
>4) Apply patch and refresh page
>5) Run steps 1-3 again and confirm no warns show
>
>Sponsored-by: Catalyst IT
>---
> svc/letters/get |  4 +++-
> tools/letter.pl | 11 +++++++----
> 2 files changed, 10 insertions(+), 5 deletions(-)
>
>diff --git a/svc/letters/get b/svc/letters/get
>index 708de74..dabb8db 100755
>--- a/svc/letters/get
>+++ b/svc/letters/get
>@@ -47,7 +47,9 @@ Used to get letters with a given letter code.
> our ( $query, $response ) = C4::Service->init( tools => 'edit_notices' );
> 
> sub get_letters {
>-    my $letters = GetLetters({ code => $query->param('code'), branchcode => $query->param('branchcode') });
>+    my $code = scalar $query->param('code');
>+    my $branchcode = scalar $query->param('branchcode');
>+    my $letters = GetLetters({ code => $code, branchcode => $branchcode });
>     $response->param( letters => $letters );
>     C4::Service->return_success( $response );
> }
>diff --git a/tools/letter.pl b/tools/letter.pl
>index 0cc0029..f1a234b 100755
>--- a/tools/letter.pl
>+++ b/tools/letter.pl
>@@ -255,14 +255,17 @@ sub add_form {
>             push @{$field_selection}, add_fields('issues');
>         }
> 
>-        if ( $module eq 'circulation' and $code =~ /^AR_/  ) {
>+        if ( $module eq 'circulation' and $code and $code =~ /^AR_/  ) {
>             push @{$field_selection}, add_fields('article_requests');
>         }
>     }
> 
>-    my $preview_is_available = grep {/^$code$/} qw(
>-        CHECKIN CHECKOUT HOLD_SLIP
>-    );
>+    my $preview_is_available = 0;
>+
>+    if ($code) {
>+        $preview_is_available = grep {/^$code$/} qw( CHECKIN CHECKOUT HOLD_SLIP );
>+    }
>+
>     $template->param(
>         module     => $module,
>         SQLfieldnames => $field_selection,
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 7862: 88996 | 89329 | 89478