Bug 16969

Summary: Vulnerability warning for opac/opac-memberentry.pl
Product: Koha Reporter: Marc Véron <veron>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: minor    
Priority: P5 - low CC: brendan, frederic, jonathan.druart, julian.maurice, katrin.fischer, kyle, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16476
Change sponsored?: --- Patch complexity: Trivial patch
Who signed the patch off: Text to go in the release notes:
Version(s) released in:
Attachments: Bug 16969 cgi->param used in list context in opac-memberentry.pl
Bug 16969 cgi->param used in list context in opac-memberentry.pl
Bug 16969 cgi->param used in list context in opac-memberentry.pl

Description Marc Véron 2016-07-24 05:50:20 UTC
From plack-error.log:

CGI::param called in list context from package CGI::Compile::ROOT::home_marc_koha_opac_opac_2dmemberentry_2epl line 362, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Chris Cormack 2016-07-24 07:20:51 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2016-07-24 13:49:20 UTC Comment hidden (obsolete)
Comment 3 Marcel de Rooy 2016-07-24 14:16:35 UTC
Created attachment 53669 [details] [review]
Bug 16969 cgi->param used in list context in opac-memberentry.pl

To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works

Works as expected. (Note: See Bug 16960 for updating patron details).
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Kyle M Hall 2016-08-10 14:02:42 UTC
Rebased and pushed to master for 16.11, thanks Chris!
Comment 5 Frédéric Demians 2016-08-23 10:00:11 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 6 Julian Maurice 2016-08-24 09:02:09 UTC
Pushed to 3.22.x, will be in 3.22.10
Comment 7 Chris Cormack 2016-08-31 09:22:34 UTC
Pushed to 3.20.x will be in 3.20.15