From ba1de2a5e8ddd4ba032aa6a0a120929f2699311e Mon Sep 17 00:00:00 2001
From: Colin Campbell <colin.campbell@ptfs-europe.com>
Date: Fri, 13 May 2016 15:45:09 +0100
Subject: [PATCH] [SIGNED-OFF] Bug 16514: Force scalar context reading cgi
 variables

CGI's param method will default to returning in list context
if it cant determine context from the lvalue
This generates log warnings in newer versions of CGI that support
multi_param. Force scalar context in the places where param
can't ascertain its context correctly

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
in list context from package main line 105, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
---
 admin/edi_accounts.pl     | 27 ++++++++++++++-------------
 admin/edi_ean_accounts.pl | 20 +++++++++++---------
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/admin/edi_accounts.pl b/admin/edi_accounts.pl
index 5f963bd..05a5fce 100755
--- a/admin/edi_accounts.pl
+++ b/admin/edi_accounts.pl
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 
 # Copyright 2011,2014 Mark Gavillet & PTFS Europe Ltd
+# Copyright 2016 PTFS Europe Ltd
 #
 # This file is part of Koha.
 #
@@ -71,22 +72,22 @@ else {
         # validate & display
         my $id     = $input->param('id');
         my $fields = {
-            description        => $input->param('description'),
-            host               => $input->param('host'),
-            username           => $input->param('username'),
-            password           => $input->param('password'),
-            vendor_id          => $input->param('vendor_id'),
-            upload_directory   => $input->param('upload_directory'),
-            download_directory => $input->param('download_directory'),
-            san                => $input->param('san'),
-            transport          => $input->param('transport'),
+            description        => scalar $input->param('description'),
+            host               => scalar $input->param('host'),
+            username           => scalar $input->param('username'),
+            password           => scalar $input->param('password'),
+            vendor_id          => scalar $input->param('vendor_id'),
+            upload_directory   => scalar $input->param('upload_directory'),
+            download_directory => scalar $input->param('download_directory'),
+            san                => scalar $input->param('san'),
+            transport          => scalar $input->param('transport'),
             quotes_enabled     => defined $input->param('quotes_enabled'),
             invoices_enabled   => defined $input->param('invoices_enabled'),
             orders_enabled     => defined $input->param('orders_enabled'),
             responses_enabled  => defined $input->param('responses_enabled'),
             auto_orders        => defined $input->param('auto_orders'),
-            id_code_qualifier  => $input->param('id_code_qualifier'),
-            plugin             => $input->param('plugin'),
+            id_code_qualifier  => scalar $input->param('id_code_qualifier'),
+            plugin             => scalar $input->param('plugin'),
         };
 
         if ($id) {
@@ -101,9 +102,9 @@ else {
         }
     }
     elsif ( $op eq 'delete_confirmed' ) {
-
+        my $id = $input->param('id');
         $schema->resultset('VendorEdiAccount')
-          ->search( { id => $input->param('id'), } )->delete_all;
+          ->search( { id => $id, } )->delete_all;
     }
 
     # we do a default dispaly after deletes and saves
diff --git a/admin/edi_ean_accounts.pl b/admin/edi_ean_accounts.pl
index f65ab9e..62cddca 100755
--- a/admin/edi_ean_accounts.pl
+++ b/admin/edi_ean_accounts.pl
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 
 # Copyright 2012, 2014 Mark Gavillet & PTFS Europe Ltd
+# Copyright 2016 PTFS Europe Ltd
 #
 # This file is part of Koha.
 #
@@ -113,10 +114,10 @@ sub addsubmit {
 
     my $new_ean = $schema->resultset('EdifactEan')->new(
         {
-            branchcode        => $input->param('branchcode'),
-            description       => $input->param('description'),
-            ean               => $input->param('ean'),
-            id_code_qualifier => $input->param('id_code_qualifier'),
+            branchcode        => scalar $input->param('branchcode'),
+            description       => scalar $input->param('description'),
+            ean               => scalar $input->param('ean'),
+            id_code_qualifier => scalar $input->param('id_code_qualifier'),
         }
     );
     $new_ean->insert();
@@ -124,12 +125,13 @@ sub addsubmit {
 }
 
 sub editsubmit {
-    $schema->resultset('EdifactEan')->find( $input->param('id') )->update(
+    my $id = $input->param('id');
+    $schema->resultset('EdifactEan')->find( $id )->update(
         {
-            branchcode        => $input->param('branchcode'),
-            description       => $input->param('description'),
-            ean               => $input->param('ean'),
-            id_code_qualifier => $input->param('id_code_qualifier'),
+            branchcode        => scalar $input->param('branchcode'),
+            description       => scalar $input->param('description'),
+            ean               => scalar $input->param('ean'),
+            id_code_qualifier => scalar $input->param('id_code_qualifier'),
         }
     );
     return;
-- 
2.1.4