Bug 16514 - Force scalar context where param assumes a list incorrectly in admin/edi scripts
Summary: Force scalar context where param assumes a list incorrectly in admin/edi scripts
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-13 14:42 UTC by Colin Campbell
Modified: 2023-09-11 15:50 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
proposed patch (5.07 KB, patch)
2016-05-13 14:57 UTC, Colin Campbell
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables (5.49 KB, patch)
2016-08-29 04:31 UTC, Aleisha Amohia
Details | Diff | Splinter Review
Bug 16514: Force scalar context reading cgi variables (3.36 KB, patch)
2023-09-11 15:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 16514: Force scalar context reading cgi variables (3.29 KB, patch)
2023-09-11 15:50 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Colin Campbell 2016-05-13 14:42:00 UTC
CGI's param method assumes a list context when lvalue not explicitly scalar. Force the correct context to avoid errors being logged
Comment 1 Colin Campbell 2016-05-13 14:57:35 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-08-24 11:18:30 UTC
I cannot test this patch, edi_accounts.pl is not plack compatible:
Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 147.
Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl line 157.
Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 159.
Variable "$template" is not available at /home/koha/src/admin/edi_accounts.pl line 161.
Comment 3 Aleisha Amohia 2016-08-29 04:31:24 UTC
Created attachment 54965 [details] [review]
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables

CGI's param method will default to returning in list context
if it cant determine context from the lvalue
This generates log warnings in newer versions of CGI that support
multi_param. Force scalar context in the places where param
can't ascertain its context correctly

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
in list context from package main line 105, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
Comment 4 Marcel de Rooy 2016-09-02 09:18:59 UTC
(In reply to Jonathan Druart from comment #2)
> I cannot test this patch, edi_accounts.pl is not plack compatible:
> Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl
> line 147.
> Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl
> line 157.
> Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl
> line 159.
> Variable "$template" is not available at
> /home/koha/src/admin/edi_accounts.pl line 161.

Colin,
It seems that this is not hard to fix. Just make sure not to use the global lexicals in your subroutines.
Could you either send a followup here or open a new report when you would insist that this is outside the scope ?
Comment 5 Katrin Fischer 2023-09-09 20:17:21 UTC
Martin, could you have a look at this old bug and patch from Colin please?
Comment 6 Martin Renvoize 2023-09-11 15:44:55 UTC
Created attachment 155499 [details] [review]
Bug 16514: Force scalar context reading cgi variables

CGI's param method will default to returning in list context
if it cant determine context from the lvalue
This generates log warnings in newer versions of CGI that support
multi_param. Force scalar context in the places where param
can't ascertain its context correctly

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
in list context from package main line 105, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
Comment 7 Martin Renvoize 2023-09-11 15:50:15 UTC
Created attachment 155500 [details] [review]
Bug 16514: Force scalar context reading cgi variables

CGI's param method will default to returning in list context
if it cant determine context from the lvalue
This generates log warnings in newer versions of CGI that support
multi_param. Force scalar context in the places where param
can't ascertain its context correctly

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
in list context from package main line 105, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
Comment 8 Martin Renvoize 2023-09-11 15:50:56 UTC
OK.. pretty much all of this has already been done at this point.. I've rebased it, but basically just just ends up as a perltidy.

We can probably just close this now.