Bug 39213 - CGI::param called in list context from cataloguing/moveitem.pl
Summary: CGI::param called in list context from cataloguing/moveitem.pl
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Marcel de Rooy
QA Contact: Lucas Gass (lukeg)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-02-28 08:29 UTC by Marcel de Rooy
Modified: 2025-03-07 14:43 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00
Circulation function:


Attachments
Bug 39213: Force scalar on query param barcode (964 bytes, patch)
2025-02-28 08:31 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 39213: Force scalar on query param barcode (981 bytes, patch)
2025-02-28 15:35 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2025-02-28 08:29:32 UTC
CGI::param called in list context from /usr/share/koha/cataloguing/moveitem.pl line 38, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 415.

# The barcode of the item to move
my $barcode = barcodedecode($query->param('barcode'));
Comment 1 Marcel de Rooy 2025-02-28 08:31:19 UTC
Created attachment 178813 [details] [review]
Bug 39213: Force scalar on query param barcode

Test plan:
Read the patch.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2025-02-28 08:31:52 UTC
Not the first patch in this series ;) Trivial change, self SO.
Comment 3 Marcel de Rooy 2025-02-28 08:32:35 UTC
Note: The line number came from 23.11
Comment 4 Lucas Gass (lukeg) 2025-02-28 15:35:16 UTC
Created attachment 178852 [details] [review]
Bug 39213: Force scalar on query param barcode

Test plan:
Read the patch.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 5 Katrin Fischer 2025-03-07 14:43:09 UTC
Pushed for 25.05!

Well done everyone, thank you!