Bug 29758 - CGI::param in list context in boraccount.pl warning
Summary: CGI::param in list context in boraccount.pl warning
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Tomás Cohen Arazi
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 29771
  Show dependency treegraph
 
Reported: 2021-12-22 18:59 UTC by Evelyn Hartline
Modified: 2022-12-12 21:23 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This removes the cause of warning messages ([WARN] CGI::param called in list context from...) in the plack-intranet-error.log when accessing the accounting transactions tab for a patron.
Version(s) released in:
22.05.00,21.11.03,21.05.11


Attachments
Bug 29758: Get rid of warning in members/boraccount.pl (1.36 KB, patch)
2021-12-23 18:54 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29758: Get rid of warning in members/boraccount.pl (1.41 KB, patch)
2021-12-31 17:00 UTC, David Nind
Details | Diff | Splinter Review
Bug 29758: Get rid of warning in members/boraccount.pl (1.49 KB, patch)
2022-01-07 15:43 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Evelyn Hartline 2021-12-22 18:59:56 UTC
Found the following warning in plack intranet error log:

CGI::param called in list context from boraccount.pl line 58, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412.
Comment 1 Liz Rea 2021-12-22 20:04:32 UTC
Just kinda feels like something we should fix, yknow? :)
Comment 2 Tomás Cohen Arazi 2021-12-23 18:54:47 UTC
Created attachment 128907 [details] [review]
Bug 29758: Get rid of warning in members/boraccount.pl

This patch removes a noisy warning found in production logs.

To test:
1. Run:
   $ tail -f /var/log/koha/kohadev/plack-intranet-error.log
2. Open the 'Accounting' tab for a patron, then click on 'Transactions'
=> FAIL: You see this kind of warning in the logs:

[WARN] CGI::param called in list context from...
3. Apply this patch
4. Repeat 2 (change tab and go back)
=> SUCCESS: No more warning!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 3 David Nind 2021-12-31 17:00:56 UTC
Created attachment 128940 [details] [review]
Bug 29758: Get rid of warning in members/boraccount.pl

This patch removes a noisy warning found in production logs.

To test:
1. Run:
   $ tail -f /var/log/koha/kohadev/plack-intranet-error.log
2. Open the 'Accounting' tab for a patron, then click on 'Transactions'
=> FAIL: You see this kind of warning in the logs:

[WARN] CGI::param called in list context from...
3. Apply this patch
4. Repeat 2 (change tab and go back)
=> SUCCESS: No more warning!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 Jonathan Druart 2022-01-07 15:43:33 UTC
Created attachment 129192 [details] [review]
Bug 29758: Get rid of warning in members/boraccount.pl

This patch removes a noisy warning found in production logs.

To test:
1. Run:
   $ tail -f /var/log/koha/kohadev/plack-intranet-error.log
2. Open the 'Accounting' tab for a patron, then click on 'Transactions'
=> FAIL: You see this kind of warning in the logs:

[WARN] CGI::param called in list context from...
3. Apply this patch
4. Repeat 2 (change tab and go back)
=> SUCCESS: No more warning!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Fridolin Somers 2022-01-19 07:21:10 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 6 Kyle M Hall 2022-02-07 11:17:37 UTC
Pushed to 21.11.x for 21.11.03
Comment 7 Andrew Fuerste-Henry 2022-02-11 18:55:42 UTC
Pushed to 21.05.x for 21.05.11
Comment 8 Victor Grousset/tuxayo 2022-02-20 17:26:49 UTC
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.