CGI's param method assumes a list context when lvalue not explicitly scalar. Force the correct context to avoid errors being logged
Created attachment 51475 [details] [review] proposed patch Fix up were scalar needs setting explicitly. To test without patch editing an edi vendor or ean will generate 'CGI::param called in list context' warnings in log - with patch applied these should no longer appear
I cannot test this patch, edi_accounts.pl is not plack compatible: Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 147. Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl line 157. Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 159. Variable "$template" is not available at /home/koha/src/admin/edi_accounts.pl line 161.
Created attachment 54965 [details] [review] [SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
(In reply to Jonathan Druart from comment #2) > I cannot test this patch, edi_accounts.pl is not plack compatible: > Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl > line 147. > Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl > line 157. > Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl > line 159. > Variable "$template" is not available at > /home/koha/src/admin/edi_accounts.pl line 161. Colin, It seems that this is not hard to fix. Just make sure not to use the global lexicals in your subroutines. Could you either send a followup here or open a new report when you would insist that this is outside the scope ?
Martin, could you have a look at this old bug and patch from Colin please?
Created attachment 155499 [details] [review] Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
Created attachment 155500 [details] [review] Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
OK.. pretty much all of this has already been done at this point.. I've rebased it, but basically just just ends up as a perltidy. We can probably just close this now.