[Bug 35278] New: CGI::param called in list context from /usr/share/koha/admin/columns_settings.pl line 76
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Bug ID: 35278 Summary: CGI::param called in list context from /usr/share/koha/admin/columns_settings.pl line 76 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |m.de.rooy@rijksmuseum.nl |ity.org | Severity|enhancement |trivial Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 --- Comment #1 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 158605 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158605&action=edit Bug 35278: Fix warn from column_settings.pl We need to add scalar to the calls. These parameters are not meant to be used as multi_param. Test plan: Try With and without this patch on staff: Try: /cgi-bin/koha/admin/columns_settings.pl => WITHOUT: No warnings => WITH: Same. No change. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket => WITHOUT: Opens module, scrolls down. CGI::param called in list context in logfile => WITH: Opens module, scrolls down. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket&table=orders => WITHOUT: Opens module, scrolls down. CGI::param called in list context in logfile => WITH: Opens module, scrolls down. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin * Hash like: panel => acqui, admin => page, undef => table, undef => modules, $modules (SHIFTED) => WITHOUT: Acqui expanded showing: There is no page using the table configuration in this module. => CGI::param warning in log. => And: Problem = a value of table has been passed to param without key => And: Problem = a value of modules has been passed to param without key => WITH: Only the first module (Acqui) should be expanded. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin&page=basket&table=orders * Hash like: panel => acqui, admin => page, basket => table, orders => modules, $modules hash (SHIFTED) => WITHOUT: Acqui expanded showing: There is no page using the table configuration in this module. => And: CGI param log warning. => WITH:: Opens Acqui. Second module ignored. Scrolling. Try: /cgi-bin/koha/admin/columns_settings.pl?module=admin&module=acqui&page=basket&table=orders * Hash like: panel => admin, acqui=> page, basket => table, orders => modules, $modules hash (SHIFTED) => WITHOUT: Admin expanded showing: There is no page using the table configuration in this module. => And: CGI param log warning. => WITH: Admin should be expanded (page and table ignored, not in Admin). No scroll. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 --- Comment #2 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #1)
* Hash like: panel => acqui, admin => page, undef => table, undef =>
Actually not a hash, but a hash-like list. That can have odd number. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #158605|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 158632 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158632&action=edit Bug 35278: Fix warn from column_settings.pl We need to add scalar to the calls. These parameters are not meant to be used as multi_param. Test plan: Try With and without this patch on staff: Try: /cgi-bin/koha/admin/columns_settings.pl => WITHOUT: No warnings => WITH: Same. No change. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket => WITHOUT: Opens module, scrolls down. CGI::param called in list context in logfile => WITH: Opens module, scrolls down. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket&table=orders => WITHOUT: Opens module, scrolls down. CGI::param called in list context in logfile => WITH: Opens module, scrolls down. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin * Hash like: panel => acqui, admin => page, undef => table, undef => modules, $modules (SHIFTED) => WITHOUT: Acqui expanded showing: There is no page using the table configuration in this module. => CGI::param warning in log. => And: Problem = a value of table has been passed to param without key => And: Problem = a value of modules has been passed to param without key => WITH: Only the first module (Acqui) should be expanded. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin&page=basket&table=orders * Hash like: panel => acqui, admin => page, basket => table, orders => modules, $modules hash (SHIFTED) => WITHOUT: Acqui expanded showing: There is no page using the table configuration in this module. => And: CGI param log warning. => WITH:: Opens Acqui. Second module ignored. Scrolling. Try: /cgi-bin/koha/admin/columns_settings.pl?module=admin&module=acqui&page=basket&table=orders * Hash like: panel => admin, acqui=> page, basket => table, orders => modules, $modules hash (SHIFTED) => WITHOUT: Admin expanded showing: There is no page using the table configuration in this module. => And: CGI param log warning. => WITH: Admin should be expanded (page and table ignored, not in Admin). No scroll. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #4 from David Nind <david@davidnind.com> --- Testing notes (using KTD) 1.Before applying the patch, ran through the URLs and noted area accessed and any warnings in the /var/log/koha/kohadev/plack-intranet-error.log log file. 1.1 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl - No error in the log file (as expected). 1.2 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket - Scrolls down to Page: basket (as expected). Error in the log file: 1 [2023/11/07 21:16:58] [WARN] CGI::param called in list context from /kohadevbox/koha/admin/columns_settings.pl line 76, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 414. 1.3 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket&table=orders - Scrolls down to Table id: orders (as expected). Error in the log file: 2 [2023/11/07 21:20:33] [WARN] CGI::param called in list context from /kohadevbox/koha/admin/columns_settings.pl line 76, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 414. 1.4 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin - Acquisition area expanded showing: "There is no page using the table configuration in this module.". Warnings in the log file: 3 [2023/11/07 21:27:19] [WARN] Problem = a value of table has been passed to param without key at /kohadevbox/koha/C4/Templates.pm line 143. 4 [2023/11/07 21:27:19] [WARN] Problem = a value of modules has been passed to param without key at /kohadevbox/koha/C4/Templates.pm line 143. 1.5 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin&page=basket&table=orders - Acquisition area expanded showing: "There is no page using the table configuration in this module.". No additional warnings added to the log file. 1.6 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=admin&module=acqui&page=basket&table=orders - Administration area expanded showing: "There is no page using the table configuration in this module.". No additional warnings added to the logfile. 2. Applied patch, flush_memcached, restart_all, fresh browser. 2.1 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl - No error in the log file (as expected). 2.2 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket - Scrolls down to Page: basket (as expected). No error in the log file. (Results as expected.) 2.3 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket&table=orders - Scrolls down to Table id: orders. No error in the log file. (Results as expected.) 2.4 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin - Acquisition area expanded. No error in the log file. (Results as expected.) 2.5 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin&page=basket&table=orders - Acquisition area expanded at Table id: orders. No error in the log file. (Results as expected.) 2.6 http://127.0.0.1:8081/cgi-bin/koha/admin/columns_settings.pl?module=admin&module=acqui&page=basket&table=orders - Administration area expanded, at the top. No error in the log file. (Results as expected.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 --- Comment #5 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Thx David. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emily.lamancusa@montgomeryc | |ountymd.gov QA Contact|testopia@bugs.koha-communit |emily.lamancusa@montgomeryc |y.org |ountymd.gov -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #158632|0 |1 is obsolete| | --- Comment #6 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 158753 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158753&action=edit Bug 35278: Fix warn from column_settings.pl We need to add scalar to the calls. These parameters are not meant to be used as multi_param. Test plan: Try With and without this patch on staff: Try: /cgi-bin/koha/admin/columns_settings.pl => WITHOUT: No warnings => WITH: Same. No change. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket => WITHOUT: Opens module, scrolls down. CGI::param called in list context in logfile => WITH: Opens module, scrolls down. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&page=basket&table=orders => WITHOUT: Opens module, scrolls down. CGI::param called in list context in logfile => WITH: Opens module, scrolls down. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin * Hash like: panel => acqui, admin => page, undef => table, undef => modules, $modules (SHIFTED) => WITHOUT: Acqui expanded showing: There is no page using the table configuration in this module. => CGI::param warning in log. => And: Problem = a value of table has been passed to param without key => And: Problem = a value of modules has been passed to param without key => WITH: Only the first module (Acqui) should be expanded. Try: /cgi-bin/koha/admin/columns_settings.pl?module=acqui&module=admin&page=basket&table=orders * Hash like: panel => acqui, admin => page, basket => table, orders => modules, $modules hash (SHIFTED) => WITHOUT: Acqui expanded showing: There is no page using the table configuration in this module. => And: CGI param log warning. => WITH:: Opens Acqui. Second module ignored. Scrolling. Try: /cgi-bin/koha/admin/columns_settings.pl?module=admin&module=acqui&page=basket&table=orders * Hash like: panel => admin, acqui=> page, basket => table, orders => modules, $modules hash (SHIFTED) => WITHOUT: Admin expanded showing: There is no page using the table configuration in this module. => And: CGI param log warning. => WITH: Admin should be expanded (page and table ignored, not in Admin). No scroll. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |23.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 23.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable CC| |fridolin.somers@biblibre.co | |m Version(s)|23.11.00 |23.11.00,23.05.06 released in| | --- Comment #8 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.05.x for 23.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|23.11.00,23.05.06 |23.11.00,23.05.06,22.11.12 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35278 --- Comment #9 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- Nice work everyone! Pushed to 22.11.x for next release -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org