[Bug 14467] New: Security updates break some Koha plugins
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Bug ID: 14467 Summary: Security updates break some Koha plugins Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: gmcharlt@gmail.com Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 --- Comment #1 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 40681 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40681&action=edit Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gmcharlt@gmail.com |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 --- Comment #2 from Kyle M Hall <kyle@bywatersolutions.com> --- Note this patch requires a new module Cwd. I don't find any evidence that it has been packaged for Debian, however it is also marked as optional and only needed for the Plugins system. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Kyle M Hall from comment #2)
Note this patch requires a new module Cwd. I don't find any evidence that it has been packaged for Debian, however it is also marked as optional and only needed for the Plugins system.
It's been a core module since at least Perl 5.8.8 as far as I can tell. http://perldoc.perl.org/5.8.8/index-modules-C.html -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set of patches - could this be the reason for the plugin problems? (see bug 14408 and the branches on git for the reverts/changes) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 --- Comment #5 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to M. Tompsett from comment #3)
(In reply to Kyle M Hall from comment #2)
Note this patch requires a new module Cwd. I don't find any evidence that it has been packaged for Debian, however it is also marked as optional and only needed for the Plugins system.
It's been a core module since at least Perl 5.8.8 as far as I can tell. http://perldoc.perl.org/5.8.8/index-modules-C.html
Thanks! I was just about to post that. I thought it quite odd that it had no package yet a submodule for it did! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 --- Comment #6 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Katrin Fischer from comment #4)
Hi Kyle, I think 2 of the security releases (3.16 and 3.14) had a wrong set of patches - could this be the reason for the plugin problems? (see bug 14408 and the branches on git for the reverts/changes)
I don't think this. I believe this is directly caused by the new check for previous directory ( i.e. ".." ) in file paths. The problem is Module::Bundled::Files creates patches using .. in it, and thus it fails that test. Cwd takes that weird path and converts it to a safe path. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 --- Comment #7 from Kyle M Hall <kyle@bywatersolutions.com> --- s/patches/paths -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Nick Clemens <nick@quecheelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Nick Clemens <nick@quecheelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40681|0 |1 is obsolete| | --- Comment #8 from Nick Clemens <nick@quecheelibrary.org> --- Created attachment 40742 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40742&action=edit [SIGNED OFF] Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@biblibre.co | |m --- Comment #9 from Jonathan Druart <jonathan.druart@biblibre.com> --- Sorry, there is something wrong in my configuration, I don't manage to test plugins (always got a 403). I am wondering if it's useful to put Cwd in the deps list, it's part of the Perl core modules. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40742|0 |1 is obsolete| | --- Comment #10 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 40763 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40763&action=edit Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Since Cwd is part of the Perl code modules, it's certainly useless to put it in the dependency list -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Jacek Ablewicz <abl@biblos.pk.edu.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |14408 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Jacek Ablewicz <abl@biblos.pk.edu.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abl@biblos.pk.edu.pl -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40763|0 |1 is obsolete| | --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 40825 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40825&action=edit Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40825|0 |1 is obsolete| | --- Comment #12 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 40826 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40826&action=edit Bug 14467 - Security updates break some Koha plugins The new security updates break previously functioning plugins, most notably the cover flow plugin and the Ebsco EDS plugin. Test Plan: 1) Install and configure the cover flow plugin ( http://bywatersolutions.com/koha-plugins/ ) 2) Note that attempting to access coverflow.pl from the OPAC results in an error 3) Apply this patch 4) Note that coverflow.pl now output html again Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |tomascohen@gmail.com --- Comment #13 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Patch pushed to master. Thanks Kyle! Thanks for amending it. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |chris@bigballofwax.co.nz --- Comment #14 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.20.x will be in 3.20.2 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |liz@catalyst.net.nz --- Comment #15 from Liz Rea <liz@catalyst.net.nz> --- Pushed to 3.18.x will be in 3.18.09 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com --- Comment #16 from Mason James <mtj@kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.13 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |14718 Referenced Bugs: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14718 [Bug 14718] Documentation/screenshot update -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14467 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|14718 | Referenced Bugs: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14718 [Bug 14718] Documentation/screenshot update -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org