|
Description
Mark Tompsett
2015-04-29 05:22:34 UTC
Created attachment 39157 [details] [review] Bug 14076: silence warnings in opac/opac-authorities-home.pl TEST PLAN --------- 1) Blank your koha opac error log file 2) Open your OPAC 3) Click 'Authority search' 4) Click 'Submit' 5) Review the koha opac error log file -- the end should have messages about security vunerabilities because CGI param is used in a list context. 6) blank your koha opac error log file 7) apply patch 8) repeat steps 2-5 -- this time, those security warnings should be gone. -- if you see an oAuth error, that's because you have no authority records and the search failed as a result. 9) run koha qa test tools. Marc, you still see those messages? On current master (aa8bd7a Koha 3.20 beta) I see no messages at all (In reply to Bernardo Gonzalez Kriegel from comment #2) > Marc, you still see those messages? > On current master (aa8bd7a Koha 3.20 beta) I see no messages at all Greetings, I do. I should have also mentioned. This will require Apache 2.4. (In reply to M. Tompsett from comment #3) ... > Greetings, I do. I should have also mentioned. This will require Apache 2.4. Ah! I have 2.2, will try in another machine (In reply to Bernardo Gonzalez Kriegel from comment #4) > (In reply to M. Tompsett from comment #3) > ... > > Greetings, I do. I should have also mentioned. This will require Apache 2.4. > > Ah! I have 2.2, will try in another machine Tried, Server version: Apache/2.4.7 (Ubuntu) No warns Test with a newer version of Perl. This was Perl 5.20.2 under Debian. CGI is a core module. This would need to be extended... extensively. This is not a Apache2.4 issue, as our client is still 2.2. This is not a Perl 5.20 issue, as our client is 5.14.2 I suspect this is a CGI.pm issue since we upgraded it. Maybe? Anyway: the logs are filled with this warning, for every conceivable source in the code: CGI::param called in list context from /home/i/git/koha-ahuntsic-prod-ccsr/circ/circulation.pl line 110, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/local/share/perl/5.14.2/CGI.pm line 404 (same for lines 114,413,414, in Koha 3.18.04) Other warners: svc/checkouts line 46 svc/members/search line 33 additem.pl line 622 detail.pl line 364 C4/Biblio.pm line 2619 and so on... See #13671 for similar issue (unrelated to the bug) Yes, if you are running Debian Jessie, you will trigger this. :) Arf looks like multi_param() method does not exist in Wheezy version of CGI.pm, only since Jessie. (In reply to Fridolin SOMERS from comment #9) > Arf looks like multi_param() method does not exist in Wheezy version of > CGI.pm, only since Jessie. How disappointing! I have confirmed with a fresh install of Debian 7.8 that only has CGI version 3.52, and multi_param is not introduced until CGI version 4.08, and Jessie has CGI version 4.09, which is why it is there. Suggestions on a wheezy-friendly solution? Created attachment 47967 [details] [review] Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl See bug 15809 for more info on why we should not use CGI->param in list context. Note: I have not found any places where several values for the same params are passed to this script but, just in case, this patch won't change this ability. Test plan: Do an authority search at the OPAC Test with several values of the form. Confirm that the results are always the same before and after this patch. Created attachment 48047 [details] [review] [SIGNED-OFF] Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl See bug 15809 for more info on why we should not use CGI->param in list context. Note: I have not found any places where several values for the same params are passed to this script but, just in case, this patch won't change this ability. Test plan: Do an authority search at the OPAC Test with several values of the form. Confirm that the results are always the same before and after this patch. NOTE: Tested in conjuction with bug 15809 Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Created attachment 49584 [details] [review] Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl See bug 15809 for more info on why we should not use CGI->param in list context. Note: I have not found any places where several values for the same params are passed to this script but, just in case, this patch won't change this ability. Test plan: Do an authority search at the OPAC Test with several values of the form. Confirm that the results are always the same before and after this patch. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to Master - Should be in the May 2016 Release. Thanks! Patch pushed to 3.22.x, will be in 3.22.6 Pushed to 3.22.x, will be in 3.20.11. |