Bug 19230

Summary: Warn when deleting a course in course reserves
Product: Koha Reporter: Aleisha Amohia <aleisha>
Component: Course reservesAssignee: Aleisha Amohia <aleisha>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: minor    
Priority: P5 - low CC: jonathan.druart, m.de.rooy, nick, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: Sponsored Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 19230: Preventing warn when deleting course
Bug 19230: Preventing warn when deleting course
Bug 19230: Preventing warn when deleting course
Bug 19230: Preventing warn when deleting course
Bug 19230: Preventing warn when deleting course
Bug 19230: Preventing warn when deleting course
Bug 19230: (follow-up) Preventing warn when deleting course

Description Aleisha Amohia 2017-08-31 21:40:36 UTC
To reproduce:
1) Ensure UseCourseReserves is enabled
2) Go to Course Reserves, create a course
3) Delete course
4) Notice warn
CGI::param called in list context from package CGI::Compile::ROOT::home_vagrant_kohaclone_course_reserves_mod_course_2epl line 43, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Aleisha Amohia 2017-08-31 21:49:20 UTC Comment hidden (obsolete)
Comment 2 Katrin Fischer 2017-10-07 13:04:14 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2017-12-19 15:26:54 UTC
I think it would be better to assign a $course_id variable and reuse it.
Something like:

modified: course_reserves/mod_course.pl
@ mod_course.pl:41 @ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
 );

 my $action = $cgi->param('action') || '';
+my $course_id = $cgi->param('course_id');

 if ( $action eq 'del' ) {
-    DelCourse( $cgi->param('course_id') );
+    DelCourse( $course_id );
     print $cgi->redirect("/cgi-bin/koha/course_reserves/course-reserves.pl");
 } else {
     my %params;

-    $params{'course_id'} = $cgi->param('course_id')
-      if ( $cgi->param('course_id') );
+    $params{'course_id'} = $course_id;
     $params{'department'}     = $cgi->param('department');
     $params{'course_number'}  = $cgi->param('course_number');
     $params{'section'}        = $cgi->param('section');
@ mod_course.pl:60 @ if ( $action eq 'del' ) {
     $params{'students_count'} = $cgi->param('students_count');
     $params{'enabled'}        = ( $cgi->param('enabled') eq 'on' ) ? 'yes' : 'no';

-    my $course_id = ModCourse(%params);
+    my $new_course_id = ModCourse(%params);

     my @instructors = $cgi->multi_param('instructors');
     ModCourseInstructors(
         mode        => 'replace',
         cardnumbers => \@instructors,
-        course_id   => $course_id
+        course_id   => $new_course_id
     );
-    print $cgi->redirect("/cgi-bin/koha/course_reserves/course-details.pl?course_id=$course_id");
+    print $cgi->redirect("/cgi-bin/koha/course_reserves/course-details.pl?course_id=$new_course_id");
 }

Would it make more sense?
Comment 4 Katrin Fischer 2017-12-20 07:10:41 UTC
Created attachment 69946 [details] [review]
Bug 19230: Preventing warn when deleting course

To test:
1) Ensure UseCourseReserves is enabled
2) Go to Course Reserves, create a course
3) Delete course
4) Notice warn
5) Apply patch
6) Create a course again and delete it
7) Notice no warn

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Aleisha Amohia 2017-12-21 01:10:07 UTC
(In reply to Jonathan Druart from comment #3)

> Would it make more sense?

hi Jonathan,
Yes I believe your fix makes more sense so I have implemented in the next patch.

When I was testing, I also found a new warn when looking at a course with NO course reserves in it (course_reserves/course-details.pl)
Argument "" isn't numeric in numeric gt (>) at /home/vagrant/kohaclone/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt line 219.

Also, when deleting a course with no course reserves, the confirm message is not triggered.

I've added a fix for this also in my next patch.
Comment 6 Aleisha Amohia 2017-12-21 01:11:46 UTC
Created attachment 69985 [details] [review]
Bug 19230: Preventing warn when deleting course

To test:
1) Ensure UseCourseReserves is enabled
2) Go to Course Reserves, create a course
3) When you are taken to the course page, you should notice the
'Argument "" isn't numeric in numeric gt' warn
4) Delete course
5) Notice warn, and that no confirm message popped up
6) Apply patch
7) Create a course again. Confirm the 'Argument "" isn't numeric in
numeric gt' warn did not show
8) Delete the course
9) Notice no warn and the confirm message pops up

Sponsored-by: Catalyst IT
Comment 7 Roch D'Amour 2018-01-19 20:46:42 UTC
Created attachment 70780 [details] [review]
Bug 19230: Preventing warn when deleting course

To test:
1) Ensure UseCourseReserves is enabled
2) Go to Course Reserves, create a course
3) When you are taken to the course page, you should notice the
'Argument "" isn't numeric in numeric gt' warn
4) Delete course
5) Notice warn, and that no confirm message popped up
6) Apply patch
7) Create a course again. Confirm the 'Argument "" isn't numeric in
numeric gt' warn did not show
8) Delete the course
9) Notice no warn and the confirm message pops up

Sponsored-by: Catalyst IT
Signed-off-by: Roch D'Amour <roch.damour@inlibro.com>
Comment 8 Marcel de Rooy 2018-01-26 07:35:57 UTC
Created attachment 70933 [details] [review]
Bug 19230: Preventing warn when deleting course

To test:
1) Ensure UseCourseReserves is enabled
2) Go to Course Reserves, create a course
3) When you are taken to the course page, you should notice the
'Argument "" isn't numeric in numeric gt' warn
4) Delete course
5) Notice warn, and that no confirm message popped up
6) Apply patch
7) Create a course again. Confirm the 'Argument "" isn't numeric in
numeric gt' warn did not show
8) Delete the course
9) Notice no warn and the confirm message pops up

Sponsored-by: Catalyst IT
Signed-off-by: Roch D'Amour <roch.damour@inlibro.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Jonathan Druart 2018-01-30 17:07:17 UTC
Created attachment 71067 [details] [review]
Bug 19230: (follow-up) Preventing warn when deleting course

Simplify 'unless' statement
Comment 10 Jonathan Druart 2018-01-30 17:25:57 UTC
Pushed to master for 18.05, thanks to everybody involved!
Comment 11 Nick Clemens (kidclamp) 2018-02-12 20:57:16 UTC
Awesome work all!

This patch has been pushed to 17.11.x and will be in 17.11.03