Bug 15809 is now pushed, we are able to replace the occurrences of CGI->param with CGI->multi_param when needed (in list context). my @foo = $cgi->param('foo'); must be replaced with my @foo = $cgi->multi_param('foo'); and $template->param( foo => $cgi->param('foo') ); must be replaced with $template->param( foo => scalar $cgi->param('foo') );
Created attachment 49624 [details] [review] Bug 16154: CGI->multi_param - Declare a list This patch replaces the occurrences of my @foo = $cgi->param('foo'); with my @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*my\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl
Created attachment 49625 [details] [review] Bug 16154: CGI->multi_param - Manual changes This patch does the same as the previous one, but affects lines which have not been caught by the regex.
Created attachment 49626 [details] [review] Bug 16154: CGI->multi_param - Force scalar context This patch replaces the occurrences of $template->param( foo => $cgi->param('foo') ); with $template->param( foo => scalar $cgi->param('foo') ); perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar \$$2\->param\(/xms' **/*.pl
Created attachment 49627 [details] [review] Bug 16154: CGI->multi_param - Assign a list This patch replaces the occurrences of @foo = $cgi->param('foo'); with @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl
This is the kind of patchset that does not have a clear and specific test plan. The expected goal is to 1. get rid of the warning "CGI::param called in list context" in logs, 2. fix the vulnerability caused by the calls of CGI->param in list context (see description of bug 15809 if you need more info about that). An important thing to check is that the subroutines modified by this patch should not be called from scripts which do not use C4::Context (if multi_param is called).
*** Bug 16150 has been marked as a duplicate of this bug. ***
Applying: Bug 16154: CGI->multi_param - Declare a list Applying: Bug 16154: CGI->multi_param - Manual changes Applying: Bug 16154: CGI->multi_param - Force scalar context fatal: sha1 information is lacking or useless (admin/patron-attr-types.pl). Repository lacks necessary blobs to fall back on 3-way merge. Cannot fall back to three-way merge. Patch failed at 0001 Bug 16154: CGI->multi_param - Force scalar context
Created attachment 50175 [details] [review] Bug 16154: CGI->multi_param - Force scalar context This patch replaces the occurrences of $template->param( foo => $cgi->param('foo') ); with $template->param( foo => scalar $cgi->param('foo') ); perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar \$$2\->param\(/xms' **/*.pl
Created attachment 50176 [details] [review] Bug 16154: CGI->multi_param - Assign a list This patch replaces the occurrences of @foo = $cgi->param('foo'); with @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl
Created attachment 50203 [details] [review] [SIGNED-OFF] Bug 16154: CGI->multi_param - Declare a list This patch replaces the occurrences of my @foo = $cgi->param('foo'); with my @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*my\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 50204 [details] [review] [SIGNED-OFF] Bug 16154: CGI->multi_param - Manual changes This patch does the same as the previous one, but affects lines which have not been caught by the regex. Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 50205 [details] [review] [SIGNED-OFF] Bug 16154: CGI->multi_param - Force scalar context This patch replaces the occurrences of $template->param( foo => $cgi->param('foo') ); with $template->param( foo => scalar $cgi->param('foo') ); perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar \$$2\->param\(/xms' **/*.pl Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 50206 [details] [review] [SIGNED-OFF] Bug 16154: CGI->multi_param - Assign a list This patch replaces the occurrences of @foo = $cgi->param('foo'); with @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl Signed-off-by: Owen Leonard <oleonard@myacpl.org>
I tried to go through all the affected pages looking for problems and everything looked good, nothing broken. I did find errors in my log for some files, so I think a follow-up is required: acqui/histsearch.pl admin/aqbudgetperiods.pl admin/aqcontract.pl admin/authorised_values.pl admin/branches.pl admin/categories.pl admin/patron-attr-types.pl admin/preferences.pl catalogue/itemsearch.pl catalogue/search.pl circ/circulation.pl patroncards/add_user_search.pl reserve/request.pl serials/add_user_search.pl serials/checkexpiration.pl tools/koha-news.pl tools/letter.pl virtualshelves/shelves.pl Each of these left an error in my log about "CGI::param called in list context"
Created attachment 50207 [details] [review] Bug 16154: Fix some other occurrences
(In reply to Owen Leonard from comment #14) > I tried to go through all the affected pages looking for problems and > everything looked good, nothing broken. > > I did find errors in my log for some files, so I think a follow-up is > required Thanks Owen for testing. This follow-up won't fix all the files you listed, but almost all of them. I'd suggest to open another bug report to catching the others.
Created attachment 50229 [details] [review] [SIGNED-OFF] Bug 16154: Fix some other occurrences Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Sorry, patches no longer apply cleanly, can you please rebase? Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 16154: CGI->multi_param - Declare a list Applying: Bug 16154: CGI->multi_param - Manual changes Applying: Bug 16154: CGI->multi_param - Force scalar context fatal: sha1 information is lacking or useless (admin/patron-attr-types.pl). Repository lacks necessary blobs to fall back on 3-way merge. Cannot fall back to three-way merge. Patch failed at 0001 Bug 16154: CGI->multi_param - Force scalar context The copy of the patch that failed is found in: /home/katrin/kohaclone/.git/rebase-apply/patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/SIGNED-OFF-Bug-16154-CGI-multiparam---Force-scalar-CQshm9.patch
Created attachment 50644 [details] [review] Bug 16154: CGI->multi_param - Declare a list This patch replaces the occurrences of my @foo = $cgi->param('foo'); with my @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*my\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl
Created attachment 50645 [details] [review] Bug 16154: CGI->multi_param - Manual changes This patch does the same as the previous one, but affects lines which have not been caught by the regex.
Created attachment 50646 [details] [review] Bug 16154: CGI->multi_param - Force scalar context This patch replaces the occurrences of $template->param( foo => $cgi->param('foo') ); with $template->param( foo => scalar $cgi->param('foo') ); perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar \$$2\->param\(/xms' **/*.pl
Created attachment 50647 [details] [review] Bug 16154: CGI->multi_param - Assign a list This patch replaces the occurrences of @foo = $cgi->param('foo'); with @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl
Created attachment 50648 [details] [review] Bug 16154: Fix some other occurrences
Created attachment 50752 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Declare a list This patch replaces the occurrences of my @foo = $cgi->param('foo'); with my @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*my\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50753 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Manual changes This patch does the same as the previous one, but affects lines which have not been caught by the regex. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50754 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Force scalar context This patch replaces the occurrences of $template->param( foo => $cgi->param('foo') ); with $template->param( foo => scalar $cgi->param('foo') ); perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar \$$2\->param\(/xms' **/*.pl Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50755 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Assign a list This patch replaces the occurrences of @foo = $cgi->param('foo'); with @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50756 [details] [review] [PASSED QA] Bug 16154: Fix some other occurrences Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
It looks like we lost Owen's sign-off line at some point. I am adding it back.
Created attachment 50757 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Declare a list This patch replaces the occurrences of my @foo = $cgi->param('foo'); with my @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*my\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50758 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Manual changes This patch does the same as the previous one, but affects lines which have not been caught by the regex. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50759 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Force scalar context This patch replaces the occurrences of $template->param( foo => $cgi->param('foo') ); with $template->param( foo => scalar $cgi->param('foo') ); perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar \$$2\->param\(/xms' **/*.pl Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50760 [details] [review] [PASSED QA] Bug 16154: CGI->multi_param - Assign a list This patch replaces the occurrences of @foo = $cgi->param('foo'); with @foo = $cgi->multi_param('foo'); perl -p -i -e 's/^(\s*@\w+\s*=\s*)\$(cgi|input|query)\->param\(/$1\$$2\->multi_param\(/xms' **/*.pl Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 50761 [details] [review] [PASSED QA] Bug 16154: Fix some other occurrences Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to Master - Should be in the May 2016 Release. Thanks!
Patches pushed to 3.22.x, will be in 3.22.7