Bug 16969 - Vulnerability warning for opac/opac-memberentry.pl
Summary: Vulnerability warning for opac/opac-memberentry.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Owen Leonard
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-24 05:50 UTC by Marc Véron
Modified: 2017-12-07 22:15 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 16969 cgi->param used in list context in opac-memberentry.pl (958 bytes, patch)
2016-07-24 07:20 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16969 cgi->param used in list context in opac-memberentry.pl (1.04 KB, patch)
2016-07-24 13:49 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 16969 cgi->param used in list context in opac-memberentry.pl (1.14 KB, patch)
2016-07-24 14:16 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Véron 2016-07-24 05:50:20 UTC
From plack-error.log:

CGI::param called in list context from package CGI::Compile::ROOT::home_marc_koha_opac_opac_2dmemberentry_2epl line 362, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Chris Cormack 2016-07-24 07:20:51 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2016-07-24 13:49:20 UTC Comment hidden (obsolete)
Comment 3 Marcel de Rooy 2016-07-24 14:16:35 UTC
Created attachment 53669 [details] [review]
Bug 16969 cgi->param used in list context in opac-memberentry.pl

To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works

Works as expected. (Note: See Bug 16960 for updating patron details).
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Kyle M Hall 2016-08-10 14:02:42 UTC
Rebased and pushed to master for 16.11, thanks Chris!
Comment 5 Frédéric Demians 2016-08-23 10:00:11 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 6 Julian Maurice 2016-08-24 09:02:09 UTC
Pushed to 3.22.x, will be in 3.22.10
Comment 7 Chris Cormack 2016-08-31 09:22:34 UTC
Pushed to 3.20.x will be in 3.20.15