http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |minor -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 --- Comment #1 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 39157 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=39157&action=edit Bug 14076: silence warnings in opac/opac-authorities-home.pl TEST PLAN --------- 1) Blank your koha opac error log file 2) Open your OPAC 3) Click 'Authority search' 4) Click 'Submit' 5) Review the koha opac error log file -- the end should have messages about security vunerabilities because CGI param is used in a list context. 6) blank your koha opac error log file 7) apply patch 8) repeat steps 2-5 -- this time, those security warnings should be gone. -- if you see an oAuth error, that's because you have no authority records and the search failed as a result. 9) run koha qa test tools. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |mtompset@hotmail.com -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Bernardo Gonzalez Kriegel from comment #2)

Marc, you still see those messages? On current master (aa8bd7a Koha 3.20 beta) I see no messages at all

Greetings, I do. I should have also mentioned. This will require Apache 2.4. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |In Discussion --- Comment #5 from Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> --- (In reply to Bernardo Gonzalez Kriegel from comment #4)

(In reply to M. Tompsett from comment #3) ...

...

Greetings, I do. I should have also mentioned. This will require Apache 2.4.

Ah! I have 2.2, will try in another machine

Tried, Server version: Apache/2.4.7 (Ubuntu) No warns -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 Blou <philippe.blouin@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |philippe.blouin@inlibro.com --- Comment #7 from Blou <philippe.blouin@inlibro.com> --- This would need to be extended... extensively. This is not a Apache2.4 issue, as our client is still 2.2. This is not a Perl 5.20 issue, as our client is 5.14.2 I suspect this is a CGI.pm issue since we upgraded it. Maybe? Anyway: the logs are filled with this warning, for every conceivable source in the code: CGI::param called in list context from /home/i/git/koha-ahuntsic-prod-ccsr/circ/circulation.pl line 110, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/local/share/perl/5.14.2/CGI.pm line 404 (same for lines 114,413,414, in Koha 3.18.04) Other warners: svc/checkouts line 46 svc/members/search line 33 additem.pl line 622 detail.pl line 364 C4/Biblio.pm line 2619 and so on... See #13671 for similar issue (unrelated to the bug) -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |In Discussion --- Comment #10 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Fridolin SOMERS from comment #9)

Arf looks like multi_param() method does not exist in Wheezy version of CGI.pm, only since Jessie.

How disappointing! I have confirmed with a fresh install of Debian 7.8 that only has CGI version 3.52, and multi_param is not introduced until CGI version 4.08, and Jessie has CGI version 4.09, which is why it is there. Suggestions on a wheezy-friendly solution? -- You are receiving this mail because: You are watching all bug changes.