Bugzilla – Attachment 51325 Details for
Bug 16476
CGI->param('foo') in list context allows XSS (e.g. Javascript injection) in Koha
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 16476: Do not call CGI->param in list context, some more
Bug-16476-Do-not-call-CGI-param-in-list-context-so.patch (text/plain), 2.77 KB, created by
Jonathan Druart
on 2016-05-09 14:04:20 UTC
(
hide
)
Description:
Bug 16476: Do not call CGI->param in list context, some more
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2016-05-09 14:04:20 UTC
Size:
2.77 KB
patch
obsolete
>From 4811767c210cccc8d75933778380e039a9337696 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 9 May 2016 15:03:12 +0100 >Subject: [PATCH] Bug 16476: Do not call CGI->param in list context, some more > >--- > Koha/Plugins/Base.pm | 2 +- > opac/ilsdi.pl | 4 ++-- > svc/members/search | 2 +- > svc/virtualshelves/search | 2 +- > 4 files changed, 5 insertions(+), 5 deletions(-) > >diff --git a/Koha/Plugins/Base.pm b/Koha/Plugins/Base.pm >index 55e1e7b..4aa8e94 100644 >--- a/Koha/Plugins/Base.pm >+++ b/Koha/Plugins/Base.pm >@@ -117,7 +117,7 @@ sub get_template { > > $template->param( > CLASS => $self->{'class'}, >- METHOD => $self->{'cgi'}->param('method'), >+ METHOD => scalar $self->{'cgi'}->param('method'), > PLUGIN_PATH => $self->get_plugin_http_path(), > ); > >diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl >index 108acc3..8320495 100755 >--- a/opac/ilsdi.pl >+++ b/opac/ilsdi.pl >@@ -128,7 +128,7 @@ unless ( $cgi->param('service') ) { > } > > # If user requested a service description, then display it >-if ( $cgi->param('service') eq "Describe" and any { $cgi->param('verb') eq $_ } @services ) { >+if ( scalar $cgi->param('service') eq "Describe" and any { scalar $cgi->param('verb') eq $_ } @services ) { > my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > { template_name => "ilsdi.tt", > query => $cgi, >@@ -137,7 +137,7 @@ if ( $cgi->param('service') eq "Describe" and any { $cgi->param('verb') eq $_ } > debug => 1, > } > ); >- $template->param( $cgi->param('verb') => 1 ); >+ $template->param( scalar $cgi->param('verb') => 1 ); > output_html_with_http_headers $cgi, $cookie, $template->output; > exit 0; > } >diff --git a/svc/members/search b/svc/members/search >index 1c2d644..2599519 100755 >--- a/svc/members/search >+++ b/svc/members/search >@@ -31,7 +31,7 @@ my $input = new CGI; > exit unless $input->param('template_path'); > > my ($template, $user, $cookie) = get_template_and_user({ >- template_name => $input->param('template_path'), >+ template_name => scalar $input->param('template_path'), > query => $input, > type => "intranet", > authnotrequired => 0, >diff --git a/svc/virtualshelves/search b/svc/virtualshelves/search >index 5e991fc..0c827c0 100755 >--- a/svc/virtualshelves/search >+++ b/svc/virtualshelves/search >@@ -13,7 +13,7 @@ my $input = new CGI; > exit unless $input->param('template_path'); > > my ($template, $user, $cookie) = get_template_and_user({ >- template_name => $input->param('template_path'), >+ template_name => scalar $input->param('template_path'), > query => $input, > type => "intranet", > authnotrequired => 0, >-- >2.7.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16476
:
51325
|
51347
|
51349