From eb4a41ad92b51f21b02a401245cf3a39ba39715d Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 12 Feb 2016 11:32:02 +0000 Subject: [PATCH] Bug 15809: Redefine multi_param is CGI < 4.08 is used On debian Jessie, the CGI version is >= 4.08 Since this version, the param method raise a warning "CGI::param called in list context". Indeed, it can cause vulnerability if called in list context https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/ There is a long journey to get rid of these warnings. First I suggest to redefine the multi_param method when the CGI version installed is < 4.08, it will allow us to move the wrong ->param calls to ->multi_param without waiting for everybody to upgrade. The different ways to call these 2 methods are: my $foo = $cgi->param('foo'); # OK my @foo = $cgi->param('foo'); # NOK, will raise the warning my @foo = $cgi->multi_param('foo'); #OK $template->param( foo => $cgi->param('foo') ); # NOK, will raise the warning # and vulnerable $template->param( foo => scalar $cgi->param('foo') ); # OK --- C4/Context.pm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/C4/Context.pm b/C4/Context.pm index 341438a..3148bda 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -76,6 +76,15 @@ BEGIN { if ($ENV{KOHA_BACKTRACES}) { $main::SIG{__DIE__} = \&CGI::Carp::confess; } + + # Redefine multi_param if cgi version is < 4.08 + # Remove the "CGI::param called in list context" warning in this case + if (!defined($CGI::VERSION) || $CGI::VERSION < 4.08) { + no warnings 'redefine'; + *CGI::multi_param = \&CGI::param; + use warnings 'redefine'; + $CGI::LIST_CONTEXT_WARN = 0; + } } # else there is no browser to send fatals to! # Check if there are memcached servers set -- 2.7.0