https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 --- Comment #1 from Peter Vashchuk <stalkernoid@gmail.com> --- Created attachment 136395 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=136395&action=edit Bug 31001: Fix "CGI::param called in list context" warning in basket.pl CGI param basketno should be explicitly scalar, or else error log gets flooded with this warning: AH01215: CGI::param called in list context from /home/vagrant/kohaclone/acqui/basket.pl line 175, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412. This patch fixes it by working with it in a scalar context. The functionality still remains the same but warning doesn't flood error log. To reproduce: 1. Head over to the acquisitions page. 2. Pick existing vendor with email contact info or create a new one. 3. Create a new basket or use existing one, and if it doesn't have any orders, add a new order to it. 4. Use the "E-mail order" button to send order. 5. Check the error log and find the upper mentioned warning. (Note: if you're going to test this more than once, you might need to restart your Plack in order for this warning to get added to your log file again, reasons of that is that the authors of CGI.pm decided to "warn only once") 6. Apply the patch. 7. Use the "E-mail order" button again, ensure that the same warning doesn't get added to the log file again. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 Andrew Nugged <nugged@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nugged@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #136395|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 136558 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=136558&action=edit Bug 31001: Fix "CGI::param called in list context" warning in basket.pl CGI param basketno should be explicitly scalar, or else error log gets flooded with this warning: AH01215: CGI::param called in list context from /home/vagrant/kohaclone/acqui/basket.pl line 175, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412. This patch fixes it by working with it in a scalar context. The functionality still remains the same but warning doesn't flood error log. To reproduce: 1. Head over to the acquisitions page. 2. Pick existing vendor with email contact info or create a new one. 3. Create a new basket or use existing one, and if it doesn't have any orders, add a new order to it. 4. Use the "E-mail order" button to send order. 5. Check the error log and find the upper mentioned warning. (Note: if you're going to test this more than once, you might need to restart your Plack in order for this warning to get added to your log file again, reasons of that is that the authors of CGI.pm decided to "warn only once") 6. Apply the patch. 7. Use the "E-mail order" button again, ensure that the same warning doesn't get added to the log file again. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #136558|0 |1 is obsolete| | --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 137249 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=137249&action=edit Bug 31001: Fix "CGI::param called in list context" warning in basket.pl CGI param basketno should be explicitly scalar, or else error log gets flooded with this warning: AH01215: CGI::param called in list context from /home/vagrant/kohaclone/acqui/basket.pl line 175, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 412. This patch fixes it by working with it in a scalar context. The functionality still remains the same but warning doesn't flood error log. To reproduce: 1. Head over to the acquisitions page. 2. Pick existing vendor with email contact info or create a new one. 3. Create a new basket or use existing one, and if it doesn't have any orders, add a new order to it. 4. Use the "E-mail order" button to send order. 5. Check the error log and find the upper mentioned warning. (Note: if you're going to test this more than once, you might need to restart your Plack in order for this warning to get added to your log file again, reasons of that is that the authors of CGI.pm decided to "warn only once") 6. Apply the patch. 7. Use the "E-mail order" button again, ensure that the same warning doesn't get added to the log file again. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 22.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arthur.suzuki@biblibre.com Status|Pushed to stable |Pushed to oldstable Version(s)|22.11.00, 22.05.04 |22.11.00, 22.05.04, released in| |21.11.11 --- Comment #7 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- pushed to 21.11.x for 21.11.11 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31001 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Acquisitions |Architecture, internals, | |and plumbing -- You are receiving this mail because: You are watching all bug changes.