Created attachment 61532 [details] [review] Bug 18320: Remove patroncards/edit-layout.pl warnings This patch removes warnings generated by the script itself. To test: - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => FAIL: Warnings logged by edit-layout.pl - Apply this patch - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => SUCCESS: No warnings generated by edit-layout.pl - Sign off :-D Without patch, I get 2 warnings (in Plack error log), while saving a layout: CGI::param called in list context from package CGI::Compile::ROOT::home_marc_koha_patroncards_edit_2dlayout_2epl line 186, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. CGI::param called in list context from package Template::Provider line 47, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. With patch (+ Plack restarted), I get the second warning only: CGI::param called in list context from package Template::Provider line 47, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. I'm assuming based on Comment 2 that this should be 'Failed QA' The remaining warning comes from manage.pl. Taking care of it Created attachment 84403 [details] [review] Bug 18320: Remove patroncards/edit-layout.pl warnings This patch removes warnings generated by the script itself. To test: - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => FAIL: Warnings logged by edit-layout.pl - Apply this patch - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => SUCCESS: No warnings generated by edit-layout.pl - Sign off :-D Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> I still see one: 1) Add a new patron layout, just entering the layout name 2) Change the Units CGI::param called in list context from /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc line 57, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412. 3) Delete layout CGI::param called in list context from /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc line 57, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412. I don't seem to be able to make them appear consistently. Can you take a look? (Marking failed QA, to get your attention ;) ) (In reply to Katrin Fischer from comment #6) > I still see one: > > > 1) Add a new patron layout, just entering the layout name > 2) Change the Units > CGI::param called in list context from > /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards- > errors.inc line 57, this can lead to vulnerabilities. See the warning in > "Fetching the value or values of a single named parameter" at > /usr/share/perl5/CGI.pm line 412. > 3) Delete layout > CGI::param called in list context from > /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards- > errors.inc line 57, this can lead to vulnerabilities. See the warning in > "Fetching the value or values of a single named parameter" at > /usr/share/perl5/CGI.pm line 412. > > I don't seem to be able to make them appear consistently. Can you take a > look? > > (Marking failed QA, to get your attention ;) ) Sorry for the delay. Will need your help testing it. Created attachment 128911 [details] [review] Bug 18320: Remove patroncards/edit-layout.pl warnings This patch removes warnings generated by the script itself. To test: - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => FAIL: Warnings logged by edit-layout.pl - Apply this patch - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => SUCCESS: No warnings generated by edit-layout.pl - Sign off :-D Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 128912 [details] [review] Bug 18320: Remove calls to CGI->param from the templates in patron cards This patch removes calls to CGI->param from within the templates (patroncards-errors.inc) and passes error_* variables with the same codes from the controllers to the template instead. This way we can be sure CGI->param is not called in list context. To test, try those pages and see they don't show warnings anymore. Verify that error situations still show the error messages. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 129193 [details] [review] Bug 18320: Remove patroncards/edit-layout.pl warnings This patch removes warnings generated by the script itself. To test: - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => FAIL: Warnings logged by edit-layout.pl - Apply this patch - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => SUCCESS: No warnings generated by edit-layout.pl - Sign off :-D Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Created attachment 129194 [details] [review] Bug 18320: Remove calls to CGI->param from the templates in patron cards This patch removes calls to CGI->param from within the templates (patroncards-errors.inc) and passes error_* variables with the same codes from the controllers to the template instead. This way we can be sure CGI->param is not called in list context. To test, try those pages and see they don't show warnings anymore. Verify that error situations still show the error messages. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> *** Bug 21051 has been marked as a duplicate of this bug. *** Pushed to master for 22.05, thanks to everybody involved [U+1F984] Pushed to 21.11.x for 21.11.03 Pushed to 21.05.x for 21.05.11 Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed. |
Steps to reproduce: - Go to Tools › Patron card creator › Manage layouts and Tools › Patron card creator › New layout - Add a new layout, adit existing. => FAIL: Warnings logged by edit-layout.pl