Bug 16969

Summary:	Vulnerability warning for opac/opac-memberentry.pl
Product:	Koha	Reporter:	Marc Véron <veron>
Component:	OPAC	Assignee:	Owen Leonard <oleonard>
Status:	CLOSED FIXED	QA Contact:	Marcel de Rooy <m.de.rooy>
Severity:	minor
Priority:	P5 - low	CC:	brendan, f.demians, jonathan.druart, julian.maurice, kyle, m.de.rooy
Version:	unspecified
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16476
Change sponsored?:	---	Patch complexity:	Trivial patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Bug 16969 cgi->param used in list context in opac-memberentry.pl Bug 16969 cgi->param used in list context in opac-memberentry.pl Bug 16969 cgi->param used in list context in opac-memberentry.pl

Description Marc Véron 2016-07-24 05:50:20 UTC

From plack-error.log:

CGI::param called in list context from package CGI::Compile::ROOT::home_marc_koha_opac_opac_2dmemberentry_2epl line 362, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.

Comment 1 Chris Cormack 2016-07-24 07:20:51 UTC Comment hidden (obsolete)

Created attachment 53667 [details] [review]
Bug 16969 cgi->param used in list context in opac-memberentry.pl

To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works

Comment 2 Marc Véron 2016-07-24 13:49:20 UTC Comment hidden (obsolete)

Created attachment 53668 [details] [review]
Bug 16969 cgi->param used in list context in opac-memberentry.pl

To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works

Works as expected. (Note: See Bug 16960 for updating patron details).
Signed-off-by: Marc <veron@veron.ch>

Comment 3 Marcel de Rooy 2016-07-24 14:16:35 UTC

Created attachment 53669 [details] [review]
Bug 16969 cgi->param used in list context in opac-memberentry.pl

To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works

Works as expected. (Note: See Bug 16960 for updating patron details).
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Comment 4 Kyle M Hall (khall) 2016-08-10 14:02:42 UTC

Rebased and pushed to master for 16.11, thanks Chris!

Comment 5 Frédéric Demians 2016-08-23 10:00:11 UTC

Pushed in 16.05. Will be in 16.05.03.

Comment 6 Julian Maurice 2016-08-24 09:02:09 UTC

Pushed to 3.22.x, will be in 3.22.10

Comment 7 Chris Cormack 2016-08-31 09:22:34 UTC

Pushed to 3.20.x will be in 3.20.15