From ba1de2a5e8ddd4ba032aa6a0a120929f2699311e Mon Sep 17 00:00:00 2001 From: Colin Campbell Date: Fri, 13 May 2016 15:45:09 +0100 Subject: [PATCH] [SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2" --- admin/edi_accounts.pl | 27 ++++++++++++++------------- admin/edi_ean_accounts.pl | 20 +++++++++++--------- 2 files changed, 25 insertions(+), 22 deletions(-) diff --git a/admin/edi_accounts.pl b/admin/edi_accounts.pl index 5f963bd..05a5fce 100755 --- a/admin/edi_accounts.pl +++ b/admin/edi_accounts.pl @@ -1,6 +1,7 @@ #!/usr/bin/perl # Copyright 2011,2014 Mark Gavillet & PTFS Europe Ltd +# Copyright 2016 PTFS Europe Ltd # # This file is part of Koha. # @@ -71,22 +72,22 @@ else { # validate & display my $id = $input->param('id'); my $fields = { - description => $input->param('description'), - host => $input->param('host'), - username => $input->param('username'), - password => $input->param('password'), - vendor_id => $input->param('vendor_id'), - upload_directory => $input->param('upload_directory'), - download_directory => $input->param('download_directory'), - san => $input->param('san'), - transport => $input->param('transport'), + description => scalar $input->param('description'), + host => scalar $input->param('host'), + username => scalar $input->param('username'), + password => scalar $input->param('password'), + vendor_id => scalar $input->param('vendor_id'), + upload_directory => scalar $input->param('upload_directory'), + download_directory => scalar $input->param('download_directory'), + san => scalar $input->param('san'), + transport => scalar $input->param('transport'), quotes_enabled => defined $input->param('quotes_enabled'), invoices_enabled => defined $input->param('invoices_enabled'), orders_enabled => defined $input->param('orders_enabled'), responses_enabled => defined $input->param('responses_enabled'), auto_orders => defined $input->param('auto_orders'), - id_code_qualifier => $input->param('id_code_qualifier'), - plugin => $input->param('plugin'), + id_code_qualifier => scalar $input->param('id_code_qualifier'), + plugin => scalar $input->param('plugin'), }; if ($id) { @@ -101,9 +102,9 @@ else { } } elsif ( $op eq 'delete_confirmed' ) { - + my $id = $input->param('id'); $schema->resultset('VendorEdiAccount') - ->search( { id => $input->param('id'), } )->delete_all; + ->search( { id => $id, } )->delete_all; } # we do a default dispaly after deletes and saves diff --git a/admin/edi_ean_accounts.pl b/admin/edi_ean_accounts.pl index f65ab9e..62cddca 100755 --- a/admin/edi_ean_accounts.pl +++ b/admin/edi_ean_accounts.pl @@ -1,6 +1,7 @@ #!/usr/bin/perl # Copyright 2012, 2014 Mark Gavillet & PTFS Europe Ltd +# Copyright 2016 PTFS Europe Ltd # # This file is part of Koha. # @@ -113,10 +114,10 @@ sub addsubmit { my $new_ean = $schema->resultset('EdifactEan')->new( { - branchcode => $input->param('branchcode'), - description => $input->param('description'), - ean => $input->param('ean'), - id_code_qualifier => $input->param('id_code_qualifier'), + branchcode => scalar $input->param('branchcode'), + description => scalar $input->param('description'), + ean => scalar $input->param('ean'), + id_code_qualifier => scalar $input->param('id_code_qualifier'), } ); $new_ean->insert(); @@ -124,12 +125,13 @@ sub addsubmit { } sub editsubmit { - $schema->resultset('EdifactEan')->find( $input->param('id') )->update( + my $id = $input->param('id'); + $schema->resultset('EdifactEan')->find( $id )->update( { - branchcode => $input->param('branchcode'), - description => $input->param('description'), - ean => $input->param('ean'), - id_code_qualifier => $input->param('id_code_qualifier'), + branchcode => scalar $input->param('branchcode'), + description => scalar $input->param('description'), + ean => scalar $input->param('ean'), + id_code_qualifier => scalar $input->param('id_code_qualifier'), } ); return; -- 2.1.4