Bug 16514

Summary: Force scalar cotext where param assumes a list incorrectly in admin/edi scripts
Product: Koha Reporter: Colin Campbell <colin.campbell>
Component: AcquisitionsAssignee: Colin Campbell <colin.campbell>
Status: ASSIGNED --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: jonathan.druart, m.de.rooy
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Who signed the patch off: Text to go in the release notes:
Version(s) released in:
Attachments: proposed patch
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables

Description Colin Campbell 2016-05-13 14:42:00 UTC
CGI's param method assumes a list context when lvalue not explicitly scalar. Force the correct context to avoid errors being logged
Comment 1 Colin Campbell 2016-05-13 14:57:35 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-08-24 11:18:30 UTC
I cannot test this patch, edi_accounts.pl is not plack compatible:
Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 147.
Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl line 157.
Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 159.
Variable "$template" is not available at /home/koha/src/admin/edi_accounts.pl line 161.
Comment 3 Aleisha Amohia 2016-08-29 04:31:24 UTC
Created attachment 54965 [details] [review]
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables

CGI's param method will default to returning in list context
if it cant determine context from the lvalue
This generates log warnings in newer versions of CGI that support
multi_param. Force scalar context in the places where param
can't ascertain its context correctly

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
in list context from package main line 105, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
Comment 4 Marcel de Rooy 2016-09-02 09:18:59 UTC
(In reply to Jonathan Druart from comment #2)
> I cannot test this patch, edi_accounts.pl is not plack compatible:
> Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl
> line 147.
> Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl
> line 157.
> Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl
> line 159.
> Variable "$template" is not available at
> /home/koha/src/admin/edi_accounts.pl line 161.

Colin,
It seems that this is not hard to fix. Just make sure not to use the global lexicals in your subroutines.
Could you either send a followup here or open a new report when you would insist that this is outside the scope ?