Bug 28302

Summary: Koha does not work with CGI::Compile 0.24
Product: Koha Reporter: Julian Maurice <julian.maurice>
Component: Architecture, internals, and plumbingAssignee: Julian Maurice <julian.maurice>
Status: CLOSED FIXED QA Contact: Kyle M Hall (khall) <kyle>
Severity: major    
Priority: P5 - low CC: andrew, dcook, fridolin.somers, jonathan.druart, kyle, mtj, victor
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28354
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.06,20.05.12,19.11.18-2
Circulation function:
Attachments: Bug 28302: Forbid CGI::Compile 0.24
Bug 28302: Forbid CGI::Compile 0.24
Bug 28302: Forbid CGI::Compile 0.24
Bug 28302: Update packages to ignore CGI::Compile 0.24
Bug 28302: Update packages to ignore CGI::Compile 0.24 (2)
Bug 28302: Update PerlDependencies.pm to CGI::Compile 0.25 (19.11.x)

Description Julian Maurice 2021-05-07 15:57:32 UTC
CGI::Compile 0.24 has a bug:
https://github.com/miyagawa/CGI-Compile/issues/25

It can cause weird bugs, like breaking the authority detail display after trying to modify an authority.

Steps to reproduce:
1. Install CGI::Compile 0.24
2. Restart starman with only 1 worker
3. Go to the detail page of an authority (authorities/detail.pl)
4. Go to the edit page (Edit » Edit record)
5. Check starman logs, you should see "Subroutine build_tabs redefined at [...]"
6. Click on cancel to go back to the detail page, which should now show a "blank" authority. Now the only way to get the authority back is to restart starman.

I suggest to just forbid CGI::Compile 0.24 in cpanfile (patch coming soon)

Warning for Ubuntu Focal users: the packaged version of CGI::Compile is 0.24
Comment 1 Julian Maurice 2021-05-07 16:00:57 UTC
Created attachment 120704 [details] [review]
Bug 28302: Forbid CGI::Compile 0.24

CGI::Compile 0.24 has a bug:
https://github.com/miyagawa/CGI-Compile/issues/25

It can cause weird bugs, like breaking the authority detail display
after trying to modify an authority.

Steps to reproduce:
1. Install CGI::Compile 0.24
2. Restart starman with only 1 worker
3. Go to the detail page of an authority (authorities/detail.pl)
4. Go to the edit page (Edit » Edit record)
5. Check starman logs, you should see "Subroutine build_tabs redefined
at [...]"
6. Click on cancel to go back to the detail page, which should now show
a "blank" authority. Now the only way to get the authority back is to
restart starman.

Test plan:
1. Reproduce the bug
2. Install CGI::Compile 0.25 and restart starman
3. Make sure the bug is gone :)
Comment 2 David Cook 2021-05-10 00:16:01 UTC
(In reply to Julian Maurice from comment #0)
> Warning for Ubuntu Focal users: the packaged version of CGI::Compile is 0.24

Yikes...

According to https://packages.ubuntu.com/search?keywords=libcgi-compile-perl&searchon=names, the only bad one is focal 20.04. 

I'll raise an issue with Ubuntu.

I don't think forbidding CGI::Compile 0.24 is going to be practical for Koha users.
Comment 4 David Cook 2021-05-10 23:29:59 UTC
So... I think that it would be OK to sign this off.

For Ubuntu Focal, we should package CGI::Compile 0.25. That doesn't need to happen in the Koha codebase, so it's not a blocker here.
Comment 5 Victor Grousset/tuxayo 2021-05-13 20:44:21 UTC
Created attachment 120952 [details] [review]
Bug 28302: Forbid CGI::Compile 0.24

CGI::Compile 0.24 has a bug:
https://github.com/miyagawa/CGI-Compile/issues/25

It can cause weird bugs, like breaking the authority detail display
after trying to modify an authority.

Steps to reproduce:
1. Install CGI::Compile 0.24
2. Restart starman with only 1 worker
3. Go to the detail page of an authority (authorities/detail.pl)
4. Go to the edit page (Edit » Edit record)
5. Check starman logs, you should see "Subroutine build_tabs redefined
at [...]"
6. Click on cancel to go back to the detail page, which should now show
a "blank" authority. Now the only way to get the authority back is to
restart starman.

Test plan:
1. Reproduce the bug
2. Install CGI::Compile 0.25 and restart starman
3. Make sure the bug is gone :)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 6 Victor Grousset/tuxayo 2021-05-13 20:50:33 UTC
It works :)
about.pl shows as expected that 0.24 is forbidden

0.24 vs 0.25 give the expected authority test results and logs.
Comment 7 Victor Grousset/tuxayo 2021-05-13 20:53:22 UTC
Test notes:
install version 0.24:

cpanm RKITOVER/CGI-Compile-0.24.tar.gz

remove version from package manager without removing dependencies and packages whose CGI::Compile is a dep (basically uninstalls all Koha stuff)

sudo dpkg -r --force-depends libcgi-compile-perl
Comment 8 Kyle M Hall (khall) 2021-05-14 15:12:33 UTC
Created attachment 120976 [details] [review]
Bug 28302: Forbid CGI::Compile 0.24

CGI::Compile 0.24 has a bug:
https://github.com/miyagawa/CGI-Compile/issues/25

It can cause weird bugs, like breaking the authority detail display
after trying to modify an authority.

Steps to reproduce:
1. Install CGI::Compile 0.24
2. Restart starman with only 1 worker
3. Go to the detail page of an authority (authorities/detail.pl)
4. Go to the edit page (Edit » Edit record)
5. Check starman logs, you should see "Subroutine build_tabs redefined
at [...]"
6. Click on cancel to go back to the detail page, which should now show
a "blank" authority. Now the only way to get the authority back is to
restart starman.

Test plan:
1. Reproduce the bug
2. Install CGI::Compile 0.25 and restart starman
3. Make sure the bug is gone :)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Jonathan Druart 2021-05-17 14:20:05 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 10 Fridolin Somers 2021-05-18 10:14:57 UTC
Pushed to 20.11.x for 20.11.06
Comment 11 Mason James 2021-05-19 15:47:44 UTC
Created attachment 121183 [details] [review]
Bug 28302: Update packages to ignore CGI::Compile 0.24

to test...
 1/ build package
 2/ install package on focal
 3/ check that libcgi-compile-perl 0.24 is not installed
Comment 12 Victor Grousset/tuxayo 2021-05-19 18:20:12 UTC
Should it not be backported to 20.05 meanwhile?
Comment 13 Mason James 2021-05-20 02:41:53 UTC
(In reply to Victor Grousset/tuxayo from comment #12)
> Should it not be backported to 20.05 meanwhile?

yes, this should be backported to 20.05 and 19.11 too
Comment 14 Jonathan Druart 2021-05-20 06:52:40 UTC
Follow-up pushed to master.
Comment 15 Mason James 2021-05-20 14:54:30 UTC
Created attachment 121243 [details] [review]
Bug 28302: Update packages to ignore CGI::Compile 0.24 (2)

to test...
 1/ build package
 2/ install package on focal
 3/ check that libcgi-compile-perl 0.24 is not installed
Comment 16 Jonathan Druart 2021-05-20 15:11:00 UTC
Follow-up pushed to master.
Comment 17 Fridolin Somers 2021-05-21 09:11:09 UTC
2 Follow-ups pushed to 20.11.x for 20.11.06
Comment 18 Andrew Fuerste-Henry 2021-05-25 13:38:11 UTC
Pushed to 20.05.x for 20.05.12
Comment 19 Victor Grousset/tuxayo 2021-05-25 14:49:51 UTC
No cpanfile on 19.11.x so I only backported:
Bug 28302: Update packages to ignore CGI::Compile 0.24
Bug 28302: Update packages to ignore CGI::Compile 0.24 (2)

Was that the right choice?

Backported: Pushed to 19.11.x branch for 19.11.18
Comment 20 Mason James 2021-05-26 21:58:06 UTC
(In reply to Victor Grousset/tuxayo from comment #19)
> No cpanfile on 19.11.x so I only backported:
> Bug 28302: Update packages to ignore CGI::Compile 0.24
> Bug 28302: Update packages to ignore CGI::Compile 0.24 (2)
> 
> Was that the right choice?

yes :)
Comment 21 Jonathan Druart 2021-05-27 13:31:21 UTC
(In reply to Mason James from comment #20)
> (In reply to Victor Grousset/tuxayo from comment #19)
> > No cpanfile on 19.11.x so I only backported:
> > Bug 28302: Update packages to ignore CGI::Compile 0.24
> > Bug 28302: Update packages to ignore CGI::Compile 0.24 (2)
> > 
> > Was that the right choice?
> 
> yes :)

Shouldn't it have been added to PerlDependencies then?
Comment 22 Mason James 2021-05-27 22:34:26 UTC
Created attachment 121465 [details] [review]
Bug 28302: Update PerlDependencies.pm to CGI::Compile 0.25 (19.11.x)

to test...
 1/ apply patch
 2/ build package
 3/ view about.pl to check CGI::Compile 0.25 version is satisfied
Comment 23 Mason James 2021-05-27 22:39:44 UTC
(In reply to Jonathan Druart from comment #21)
> (In reply to Mason James from comment #20)
> > (In reply to Victor Grousset/tuxayo from comment #19)
> > > No cpanfile on 19.11.x so I only backported:
> > > Bug 28302: Update packages to ignore CGI::Compile 0.24
> > > Bug 28302: Update packages to ignore CGI::Compile 0.24 (2)
> > > 
> > > Was that the right choice?
> > 
> > yes :)
> 
> Shouldn't it have been added to PerlDependencies then?

ah yes, thanks. i've added a patch

Victor, if you push this patch for a tiny 19.11.19 release, i can build the package
Comment 24 Victor Grousset/tuxayo 2021-05-28 06:04:35 UTC
Pushed in 19.11.18-2
Comment 25 Mason James 2022-03-02 04:43:16 UTC
(In reply to Victor Grousset/tuxayo from comment #24)
> Pushed in 19.11.18-2

thanks Victor, closing :)