[Bug 16514] New: Force scalar cotext where param assumes a list incorrectly in admin/edi scripts
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Bug ID: 16514 Summary: Force scalar cotext where param assumes a list incorrectly in admin/edi scripts Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs@lists.koha-community.org Reporter: colin.campbell@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org CGI's param method assumes a list context when lvalue not explicitly scalar. Force the correct context to avoid errors being logged -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Colin Campbell <colin.campbell@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |colin.campbell@ptfs-europe. |ity.org |com Status|NEW |Needs Signoff --- Comment #1 from Colin Campbell <colin.campbell@ptfs-europe.com> --- Created attachment 51475 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=51475&action=edit proposed patch Fix up were scalar needs setting explicitly. To test without patch editing an edi vendor or ean will generate 'CGI::param called in list context' warnings in log - with patch applied these should no longer appear -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- I cannot test this patch, edi_accounts.pl is not plack compatible: Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 147. Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl line 157. Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 159. Variable "$template" is not available at /home/koha/src/admin/edi_accounts.pl line 161. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Aleisha Amohia <aleishaamohia@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Aleisha Amohia <aleishaamohia@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #51475|0 |1 is obsolete| | --- Comment #3 from Aleisha Amohia <aleishaamohia@hotmail.com> --- Created attachment 54965 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54965&action=edit [SIGNED-OFF] Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #2)
I cannot test this patch, edi_accounts.pl is not plack compatible: Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 147. Variable "$input" is not available at /home/koha/src/admin/edi_accounts.pl line 157. Variable "$schema" is not available at /home/koha/src/admin/edi_accounts.pl line 159. Variable "$template" is not available at /home/koha/src/admin/edi_accounts.pl line 161.
Colin, It seems that this is not hard to fix. Just make sure not to use the global lexicals in your subroutines. Could you either send a followup here or open a new report when you would insist that this is outside the scope ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|colin.campbell@ptfs-europe. |martin.renvoize@ptfs-europe |com |.com Summary|Force scalar cotext where |Force scalar context where |param assumes a list |param assumes a list |incorrectly in admin/edi |incorrectly in admin/edi |scripts |scripts --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Martin, could you have a look at this old bug and patch from Colin please? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 155499 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=155499&action=edit Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |minor -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54965|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #155499|0 |1 is obsolete| | --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 155500 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=155500&action=edit Bug 16514: Force scalar context reading cgi variables CGI's param method will default to returning in list context if it cant determine context from the lvalue This generates log warnings in newer versions of CGI that support multi_param. Force scalar context in the places where param can't ascertain its context correctly Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Patch works - no longer seeing warn "edi_accounts.pl: CGI::param called in list context from package main line 105, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://localhost:8081/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=2" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16514 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED --- Comment #8 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- OK.. pretty much all of this has already been done at this point.. I've rebased it, but basically just just ends up as a perltidy. We can probably just close this now. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org