Bug 16514 - Force scalar cotext where param assumes a list incorrectly in admin/edi scripts
Summary: Force scalar cotext where param assumes a list incorrectly in admin/edi scripts
Status: ASSIGNED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Colin Campbell
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-13 14:42 UTC by Colin Campbell
Modified: 2016-10-04 13:04 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
proposed patch (5.07 KB, patch)
2016-05-13 14:57 UTC, Colin Campbell
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables (5.49 KB, patch)
2016-08-29 04:31 UTC, Aleisha Amohia
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Colin Campbell 2016-05-13 14:42:00 UTC
CGI's param method assumes a list context when lvalue not explicitly scalar. Force the correct context to avoid errors being logged
Comment 1 Colin Campbell 2016-05-13 14:57:35 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-08-24 11:18:30 UTC
I cannot test this patch, edi_accounts.pl is not plack compatible:
Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 147.
Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl line 157.
Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 159.
Variable "$template" is not available at /home/koha/src/admin/edi_accounts.pl line 161.
Comment 3 Aleisha Amohia 2016-08-29 04:31:24 UTC
Created attachment 54965 [details] [review]
[SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables

CGI's param method will default to returning in list context
if it cant determine context from the lvalue
This generates log warnings in newer versions of CGI that support
multi_param. Force scalar context in the places where param
can't ascertain its context correctly

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called
in list context from package main line 105, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /usr/share/perl5/CGI.pm line 436., referer:
http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2"
Comment 4 Marcel de Rooy 2016-09-02 09:18:59 UTC
(In reply to Jonathan Druart from comment #2)
> I cannot test this patch, edi_accounts.pl is not plack compatible:
> Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl
> line 147.
> Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl
> line 157.
> Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl
> line 159.
> Variable "$template" is not available at
> /home/koha/src/admin/edi_accounts.pl line 161.

Colin,
It seems that this is not hard to fix. Just make sure not to use the global lexicals in your subroutines.
Could you either send a followup here or open a new report when you would insist that this is outside the scope ?