From 8a389af94af3abf65f5ca96522079578bb6d6c37 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 5 Jan 2021 16:23:21 +0100 Subject: [PATCH] Bug 27337: Remove direct use of CGI::Cookie There is only 1 occurrence where there is an explanation about the direct use of CGI::Cookie, in tools/upload-file.pl The others don't seem relevant --- admin/import_export_framework.pl | 21 ++++++--------------- authorities/merge_ajax.pl | 16 +++++++++------- cataloguing/merge_ajax.pl | 16 ++++++++-------- offline_circ/enqueue_koc.pl | 2 -- offline_circ/process_koc.pl | 3 +-- opac/opac-patron-image.pl | 5 +---- opac/opac-ratings-ajax.pl | 4 +--- opac/opac-tags.pl | 4 +--- tags/review.pl | 4 +--- tools/background-job-progress.pl | 6 +----- tools/batchMod.pl | 3 +-- tools/manage-marc-import.pl | 4 +--- tools/modborrowers.pl | 2 -- tools/stage-marc-import.pl | 4 +--- tools/upload-cover-image.pl | 2 -- 15 files changed, 32 insertions(+), 64 deletions(-) diff --git a/admin/import_export_framework.pl b/admin/import_export_framework.pl index bd5ee8331b..0a1576cad4 100755 --- a/admin/import_export_framework.pl +++ b/admin/import_export_framework.pl @@ -20,27 +20,18 @@ use Modern::Perl; use CGI qw ( -utf8 ); -use CGI::Cookie; use C4::Context; use C4::Auth qw/check_cookie_auth/; use C4::ImportExportFramework; -my %cookies = CGI::Cookie->fetch(); -my $authenticated = 0; -my ($auth_status, $sessionID); -if (exists $cookies{'CGISESSID'}) { - ($auth_status, $sessionID) = check_cookie_auth( - $cookies{'CGISESSID'}->value, - { parameters => 'manage_marc_frameworks' }, - ); -} -if ($auth_status eq 'ok') { - $authenticated = 1; -} - my $input = CGI->new; -unless ($authenticated) { + +my ( $auth_status, $sessionID ) = + check_cookie_auth( $input->cookie('CGISESSID'), + { parameters => 'manage_marc_frameworks' } ); + +unless ($auth_status eq 'ok') { print $input->header(-type => 'text/plain', -status => '403 Forbidden'); exit 0; } diff --git a/authorities/merge_ajax.pl b/authorities/merge_ajax.pl index 6ed427891c..8eb1e05506 100755 --- a/authorities/merge_ajax.pl +++ b/authorities/merge_ajax.pl @@ -3,22 +3,24 @@ use Modern::Perl; use CGI qw ( -utf8 ); -use CGI::Cookie; # need to check cookies before CGI parses the POST request use JSON; use C4::Context; use C4::Auth qw/check_cookie_auth/; use C4::AuthoritiesMarc; -my %cookies = CGI::Cookie->fetch; -my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' }); -my $reply = CGI->new; +my $input = CGI->new; + +my ( $auth_status, $sessionID ) = + check_cookie_auth( $input->cookie('CGISESSID'), + { editcatalogue => 'edit_catalogue' } ); + if ($auth_status ne "ok") { - print $reply->header(-type => 'text/html'); + print $input->header(-type => 'text/html'); exit 0; } -my $framework = $reply->param('frameworkcode'); +my $framework = $input->param('frameworkcode'); my $tagslib = GetTagsLabels(1, $framework); -print $reply->header(-type => 'text/html'); +print $input->header(-type => 'text/html'); print encode_json $tagslib; diff --git a/cataloguing/merge_ajax.pl b/cataloguing/merge_ajax.pl index aef7dcbfb9..8b96d534f4 100755 --- a/cataloguing/merge_ajax.pl +++ b/cataloguing/merge_ajax.pl @@ -10,17 +10,17 @@ use C4::Context; use C4::Biblio; use C4::Auth qw/check_cookie_auth/; -my %cookies = CGI::Cookie->fetch; -my ( $auth_status, $sessionID ) = check_cookie_auth( - $cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' }, -); -my $reply = CGI->new; +my $input = CGI->new; +my ( $auth_status, $sessionID ) = + check_cookie_auth( $input->cookie('CGISESSID'), + { editcatalogue => 'edit_catalogue' } ); + if ($auth_status ne "ok") { - print $reply->header(-type => 'text/html'); + print $input->header(-type => 'text/html'); exit 0; } -my $framework = $reply->param('frameworkcode'); +my $framework = $input->param('frameworkcode'); my $tagslib = GetMarcStructure(1, $framework); -print $reply->header(-type => 'text/html'); +print $input->header(-type => 'text/html'); print encode_json $tagslib; diff --git a/offline_circ/enqueue_koc.pl b/offline_circ/enqueue_koc.pl index 7ca5699f2e..d783d3fd33 100755 --- a/offline_circ/enqueue_koc.pl +++ b/offline_circ/enqueue_koc.pl @@ -54,8 +54,6 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({ my $fileID=$query->param('uploadedfileid'); -my %cookies = parse CGI::Cookie($cookie); -my $sessionID = $cookies{'CGISESSID'}->value; ## 'Local' globals. our $dbh = C4::Context->dbh(); diff --git a/offline_circ/process_koc.pl b/offline_circ/process_koc.pl index ce2c6c5524..18ae3452b0 100755 --- a/offline_circ/process_koc.pl +++ b/offline_circ/process_koc.pl @@ -59,8 +59,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({ my $fileID=$query->param('uploadedfileid'); my $runinbackground = $query->param('runinbackground'); my $completedJobID = $query->param('completedJobID'); -my %cookies = parse CGI::Cookie($cookie); -my $sessionID = $cookies{'CGISESSID'}->value; +my $sessionID = $query->cookie('CGISESSID'); ## 'Local' globals. our $dbh = C4::Context->dbh(); our @output = (); ## For storing messages to be displayed to the user diff --git a/opac/opac-patron-image.pl b/opac/opac-patron-image.pl index b40788db7e..55c9b349dd 100755 --- a/opac/opac-patron-image.pl +++ b/opac/opac-patron-image.pl @@ -21,7 +21,6 @@ use Modern::Perl; use C4::Members; use CGI qw ( -utf8 ); -use CGI::Cookie; # need to check cookies before having CGI parse the POST request use C4::Auth qw(:DEFAULT check_cookie_auth); use Koha::Patron::Images; @@ -33,9 +32,7 @@ unless (C4::Context->preference('OPACpatronimages')) { } my $needed_flags; -my %cookies = CGI::Cookie->fetch; -my $sessid = $cookies{'CGISESSID'}->value; -my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags); +my ($auth_status, $auth_sessid) = check_cookie_auth($query->cookie('CGISESSID'), $needed_flags); my $borrowernumber = C4::Context->userenv->{'number'}; my $patron_image = Koha::Patron::Images->find($borrowernumber); diff --git a/opac/opac-ratings-ajax.pl b/opac/opac-ratings-ajax.pl index 8620368b53..f4ca8074d9 100755 --- a/opac/opac-ratings-ajax.pl +++ b/opac/opac-ratings-ajax.pl @@ -26,7 +26,6 @@ A script that takes an ajax json query, and then inserts or modifies a star-rati use Modern::Perl; use CGI qw ( -utf8 ); -use CGI::Cookie; # need to check cookies before having CGI parse the POST request use C4::Auth qw(:DEFAULT check_cookie_auth); use C4::Context; @@ -109,9 +108,8 @@ exit; # a ratings specific ajax return sub, returns CGI object, and an 'auth_success' value sub ajax_auth_cgi { my $needed_flags = shift; - my %cookies = CGI::Cookie->fetch; my $input = CGI->new; - my $sessid = $cookies{'CGISESSID'}->value || $input->param('CGISESSID'); + my $sessid = $input->cookie('CGISESSID') || $input->param('CGISESSID'); my ( $auth_status, $auth_sessid ) = check_cookie_auth( $sessid, $needed_flags ); return $input, $auth_status; diff --git a/opac/opac-tags.pl b/opac/opac-tags.pl index be3c3d5886..46ddeba3c6 100755 --- a/opac/opac-tags.pl +++ b/opac/opac-tags.pl @@ -33,7 +33,6 @@ C4::Scrubber is used to remove all markup content from the sumitted text. use Modern::Perl; use CGI qw ( -utf8 ); -use CGI::Cookie; # need to check cookies before having CGI parse the POST request use C4::Auth qw(:DEFAULT check_cookie_auth); use C4::Context; @@ -61,9 +60,8 @@ my @globalErrorIndexes = (); sub ajax_auth_cgi { # returns CGI object my $needed_flags = shift; - my %cookies = CGI::Cookie->fetch; my $input = CGI->new; - my $sessid = $cookies{'CGISESSID'}->value; + my $sessid = $input->cookie('CGISESSID'); my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags); $debug and print STDERR "($auth_status, $auth_sessid) = check_cookie_auth($sessid," . Dumper($needed_flags) . ")\n"; diff --git a/tags/review.pl b/tags/review.pl index 3acf28a9dc..e3993ac914 100755 --- a/tags/review.pl +++ b/tags/review.pl @@ -23,7 +23,6 @@ use Modern::Perl; use Data::Dumper; use POSIX; use CGI qw ( -utf8 ); -use CGI::Cookie; # need to check cookies before having CGI parse the POST request use URI::Escape; use C4::Auth qw(:DEFAULT check_cookie_auth); use C4::Context; @@ -38,9 +37,8 @@ my $needed_flags = { tools => 'moderate_tags' }; # FIXME: replace when more s sub ajax_auth_cgi { # returns CGI object my $needed_flags = shift; - my %cookies = CGI::Cookie->fetch; my $input = CGI->new; - my $sessid = $cookies{'CGISESSID'}->value; + my $sessid = $input->cookie('CGISESSID'); my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags); $debug and print STDERR "($auth_status, $auth_sessid) = check_cookie_auth($sessid," . Dumper($needed_flags) . ")\n"; diff --git a/tools/background-job-progress.pl b/tools/background-job-progress.pl index 625389f902..96425e2165 100755 --- a/tools/background-job-progress.pl +++ b/tools/background-job-progress.pl @@ -22,16 +22,12 @@ use Modern::Perl; # standard or CPAN modules used use IO::File; use CGI qw ( -utf8 ); -use CGI::Session; use C4::Context; use C4::Auth qw/check_cookie_auth/; use C4::BackgroundJob; -use CGI::Cookie; # need to check cookies before - # having CGI parse the POST request my $input = CGI->new; -my %cookies = CGI::Cookie->fetch; -my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { tools => '*' }); +my ($auth_status, $sessionID) = check_cookie_auth($input->cookie('CGISESSID'), { tools => '*' }); if ($auth_status ne "ok") { my $reply = CGI->new(""); print $reply->header(-type => 'text/html'); diff --git a/tools/batchMod.pl b/tools/batchMod.pl index dca2e41ad4..3e439c8e4d 100755 --- a/tools/batchMod.pl +++ b/tools/batchMod.pl @@ -100,8 +100,7 @@ my @not_deleted; # List of the itemnumbers that could not be deleted my $modified_items = 0; # Numbers of modified items my $modified_fields = 0; # Numbers of modified fields -my %cookies = parse CGI::Cookie($cookie); -my $sessionID = $cookies{'CGISESSID'}->value; +my $sessionID = $input->cookie('CGISESSID'); #--- ---------------------------------------------------------------------------- diff --git a/tools/manage-marc-import.pl b/tools/manage-marc-import.pl index eed338f759..6e8462fc68 100755 --- a/tools/manage-marc-import.pl +++ b/tools/manage-marc-import.pl @@ -21,7 +21,6 @@ use Modern::Perl; # standard or CPAN modules used use CGI qw ( -utf8 ); -use CGI::Cookie; use MARC::File::USMARC; # Koha modules used @@ -57,8 +56,7 @@ my ($template, $loggedinuser, $cookie) debug => 1, }); -my %cookies = parse CGI::Cookie($cookie); -our $sessionID = $cookies{'CGISESSID'}->value; +our $sessionID = $input->cookie('CGISESSID'); our $dbh = C4::Context->dbh; my $frameworks = Koha::BiblioFrameworks->search({ tagfield => { 'not' => undef } }, { join => 'marc_tag_structure', distinct => 'frameworkcode', order_by => ['frameworktext'] }); diff --git a/tools/modborrowers.pl b/tools/modborrowers.pl index 5a0193f75b..b193c6f5e0 100755 --- a/tools/modborrowers.pl +++ b/tools/modborrowers.pl @@ -51,8 +51,6 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( my $logged_in_user = Koha::Patrons->find( $loggedinuser ); -my %cookies = parse CGI::Cookie($cookie); -my $sessionID = $cookies{'CGISESSID'}->value; my $dbh = C4::Context->dbh; # Show borrower informations diff --git a/tools/stage-marc-import.pl b/tools/stage-marc-import.pl index 97767bfa1b..3a525896ca 100755 --- a/tools/stage-marc-import.pl +++ b/tools/stage-marc-import.pl @@ -28,7 +28,6 @@ use Modern::Perl; # standard or CPAN modules used use CGI qw ( -utf8 ); -use CGI::Cookie; use MARC::File::USMARC; # Koha modules used @@ -81,8 +80,7 @@ $template->param( booksellerid => $booksellerid, ); -my %cookies = parse CGI::Cookie($cookie); -my $sessionID = $cookies{'CGISESSID'}->value; +my $sessionID = $input->cookie('CGISESSID'); if ($completedJobID) { my $job = C4::BackgroundJob->fetch($sessionID, $completedJobID); my $results = $job->results(); diff --git a/tools/upload-cover-image.pl b/tools/upload-cover-image.pl index 82b0bb50b1..e50153b5c9 100755 --- a/tools/upload-cover-image.pl +++ b/tools/upload-cover-image.pl @@ -73,8 +73,6 @@ my $itemnumber = $input->param('itemnumber'); my $replace = !C4::Context->preference("AllowMultipleCovers") || $input->param('replace'); my $op = $input->param('op'); -my %cookies = parse CGI::Cookie($cookie); -my $sessionID = $cookies{'CGISESSID'}->value; my $error; -- 2.20.1