Summary: | Security updates break some Koha plugins | ||
---|---|---|---|
Product: | Koha | Reporter: | Kyle M Hall (khall) <kyle> |
Component: | Architecture, internals, and plumbing | Assignee: | Kyle M Hall (khall) <kyle> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | abl, chris, jonathan.druart, liz, mtj, mtompset, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Trivial patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | 14408 | ||
Bug Blocks: | |||
Attachments: |
Bug 14467 - Security updates break some Koha plugins
[SIGNED OFF] Bug 14467 - Security updates break some Koha plugins Bug 14467 - Security updates break some Koha plugins Bug 14467 - Security updates break some Koha plugins Bug 14467 - Security updates break some Koha plugins |
Description
Kyle M Hall (khall)
2015-06-26 16:16:00 UTC
Created attachment 40681 [details] [review] Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Note this patch requires a new module Cwd. I don't find any evidence that it has been packaged for Debian, however it is also marked as optional and only needed for the Plugins system. (In reply to Kyle M Hall from comment #2) > Note this patch requires a new module Cwd. I don't find any evidence that it > has been packaged for Debian, however it is also marked as optional and only > needed for the Plugins system. It's been a core module since at least Perl 5.8.8 as far as I can tell. http://perldoc.perl.org/5.8.8/index-modules-C.html Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set of patches - could this be the reason for the plugin problems? (see bug 14408 and the branches on git for the reverts/changes) (In reply to M. Tompsett from comment #3) > (In reply to Kyle M Hall from comment #2) > > Note this patch requires a new module Cwd. I don't find any evidence that it > > has been packaged for Debian, however it is also marked as optional and only > > needed for the Plugins system. > > It's been a core module since at least Perl 5.8.8 as far as I can tell. > http://perldoc.perl.org/5.8.8/index-modules-C.html Thanks! I was just about to post that. I thought it quite odd that it had no package yet a submodule for it did! (In reply to Katrin Fischer from comment #4) > Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set > of patches - could this be the reason for the plugin problems? (see bug > 14408 and the branches on git for the reverts/changes) I don't think this. I believe this is directly caused by the new check for previous directory ( i.e. ".." ) in file paths. The problem is Module::Bundled::Files creates patches using .. in it, and thus it fails that test. Cwd takes that weird path and converts it to a safe path. s/patches/paths Created attachment 40742 [details] [review] [SIGNED OFF] Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Sorry, there is something wrong in my configuration, I don't manage to test plugins (always got a 403). I am wondering if it's useful to put Cwd in the deps list, it's part of the Perl core modules. Created attachment 40763 [details] [review] Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Since Cwd is part of the Perl code modules, it's certainly useless to put it in the dependency list Created attachment 40825 [details] [review] Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Created attachment 40826 [details] [review] Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Patch pushed to master. Thanks Kyle! Thanks for amending it. Pushed to 3.20.x will be in 3.20.2 Pushed to 3.18.x will be in 3.18.09 Pushed to 3.16.x, will be in 3.16.13 |