| Summary: | CGI::param called in list context from acqui/addorder.pl line 182 | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
| Component: | Architecture, internals, and plumbing | Assignee: | Marcel de Rooy <m.de.rooy> |
| Status: | RESOLVED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | trivial | ||
| Priority: | P5 - low | CC: | arthur.suzuki, lucas, wainuiwitikapark |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
23.05.00,22.11.01,22.05.09, 21.11.16
|
|
| Circulation function: | |||
| Attachments: |
Bug 32457: Fix CGI vulnerability in addorder.pl
Bug 32457: Fix CGI vulnerability in addorder.pl |
||
|
Description
Marcel de Rooy
2022-12-13 14:30:49 UTC
Created attachment 144554 [details] [review] Bug 32457: Fix CGI vulnerability in addorder.pl Test plan: Go to acqui/addorder.pl. Create two items. Check if results still match your expectations. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Trivial oneliner: self SO Side-note for QA: If you examine the actual html page constructed, you'll see that this script generates a lot of garbage (hidden inputs). Created attachment 144588 [details] [review] Bug 32457: Fix CGI vulnerability in addorder.pl Test plan: Go to acqui/addorder.pl. Create two items. Check if results still match your expectations. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Pushed to master for 23.05. Nice work everyone, thanks! Nice work everyone! Pushed to 22.11.x for the next release Backported to 22.05.x for upcoming 22.05.09 applied to 21.11.x for 21.11.16 Not backported to 21.05.x |