From 89e48de6221ffd1bf3522b5a9b45e973ac387f3c Mon Sep 17 00:00:00 2001 From: Colin Campbell Date: Fri, 13 May 2016 15:45:09 +0100 Subject: [PATCH] Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2" --- admin/edi_accounts.pl | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/admin/edi_accounts.pl b/admin/edi_accounts.pl index 65e3b4e1a2..59dd306a91 100755 --- a/admin/edi_accounts.pl +++ b/admin/edi_accounts.pl @@ -1,6 +1,7 @@ #!/usr/bin/perl # Copyright 2011,2014 Mark Gavillet & PTFS Europe Ltd +# Copyright 2016 PTFS Europe Ltd # # This file is part of Koha. # @@ -78,18 +79,18 @@ else { description => scalar $input->param('description'), host => scalar $input->param('host'), username => scalar $input->param('username'), - password => $password, + password => scalar $input->param('password'), vendor_id => scalar $input->param('vendor_id'), upload_directory => scalar $input->param('upload_directory'), download_directory => scalar $input->param('download_directory'), san => scalar $input->param('san'), standard => scalar $input->param('standard'), transport => scalar $input->param('transport'), - quotes_enabled => $input->param('quotes_enabled') ? 1 : 0, - invoices_enabled => $input->param('invoices_enabled') ? 1 : 0, - orders_enabled => $input->param('orders_enabled') ? 1 : 0, + quotes_enabled => $input->param('quotes_enabled') ? 1 : 0, + invoices_enabled => $input->param('invoices_enabled') ? 1 : 0, + orders_enabled => $input->param('orders_enabled') ? 1 : 0, responses_enabled => $input->param('responses_enabled') ? 1 : 0, - auto_orders => $input->param('auto_orders') ? 1 : 0, + auto_orders => $input->param('auto_orders') ? 1 : 0, id_code_qualifier => scalar $input->param('id_code_qualifier'), plugin => scalar $input->param('plugin'), }; @@ -106,9 +107,8 @@ else { } } elsif ( $op eq 'delete_confirmed' ) { - - $schema->resultset('VendorEdiAccount') - ->search( { id => scalar $input->param('id'), } )->delete_all; + my $id = $input->param('id'); + $schema->resultset('VendorEdiAccount')->search( { id => $id } )->delete_all; } # we do a default dispaly after deletes and saves -- 2.41.0