[Bug 18633] New: Logs are full of CGI:: param called in list context - itemsearch.pl
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Bug ID: 18633 Summary: Logs are full of CGI::param called in list context - itemsearch.pl Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: julian.maurice@biblibre.com Reporter: jonathan.druart@bugs.koha-community.org QA Contact: testopia@bugs.koha-community.org The use of the CGI TT plugin in catalogue/itemsearch.tt floods logs with: itemsearch.pl: CGI::param called in list context from package Template::Document line 118, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: http://xxx/cgi-bin/koha/about.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |11425 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11425 [Bug 11425] Search form for items -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=18632 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |16154 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16154 [Bug 16154] Replace CGI->param with CGI->multi_param in list context -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=18762 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #1 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 64123 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64123&action=edit Bug 18633: Remove useless use of CGI TT plugin The form is sent using AJAX so there is never a query string in the URL (no POST parameters either) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #2 from Julian Maurice <julian.maurice@biblibre.com> --- Test plan: 1. Verify that item search works exactly the same with or without the patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #3 from Julian Maurice <julian.maurice@biblibre.com> --- And 2. Verify that "CGI::param" warns are gone -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #4 from Owen Leonard <oleonard@myacpl.org> --- I still get a warning in the log: itemsearch.pl: CGI::param called in list context from package Template::Document line 3, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #5 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 64193 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64193&action=edit Bug 18633: Remove remaining use of CGI.param in template -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff --- Comment #6 from Julian Maurice <julian.maurice@biblibre.com> --- Thanks for testing Owen. With this new patch the last warning should disappear -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Alex Buckley <alexbuckley@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexbuckley@catalyst.net.nz Status|Needs Signoff |Patch doesn't apply --- Comment #7 from Alex Buckley <alexbuckley@catalyst.net.nz> --- Merge conflict on clean up to date branch Applying: Bug 18633: Remove useless use of CGI TT plugin Using index info to reconstruct a base tree... M koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt Falling back to patching base and 3-way merge... Auto-merging koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt CONFLICT (content): Merge conflict in koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt Failed to merge in the changes. Patch failed at 0001 Bug 18633: Remove useless use of CGI TT plugin The copy of the patch that failed is found in: /home/vagrant/kohaclone/.git/rebase-apply/patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/Bug-18633-Remove-useless-use-of-CGI-TT-plugin-W31_uJ.patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64123|0 |1 is obsolete| | --- Comment #8 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 64709 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64709&action=edit Bug 18633: Remove useless use of CGI TT plugin The form is sent using AJAX so there is never a query string in the URL (no POST parameters either) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64193|0 |1 is obsolete| | --- Comment #9 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 64710 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64710&action=edit Bug 18633: Remove remaining use of CGI.param in template -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff CC| |mtompset@hotmail.com --- Comment #10 from M. Tompsett <mtompset@hotmail.com> --- Resurrected. Check for side-effects related to previous values being filled in. I think this might break something like that, but I have not tested. I merely made the patches apply cleanly. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64709|0 |1 is obsolete| | --- Comment #11 from Marc Véron <veron@veron.ch> --- Created attachment 64721 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64721&action=edit Bug 18633: Remove useless use of CGI TT plugin The form is sent using AJAX so there is never a query string in the URL (no POST parameters either) Tested both patches together, item search behaves as before, log entries are gone Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64710|0 |1 is obsolete| | --- Comment #12 from Marc Véron <veron@veron.ch> --- Created attachment 64722 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64722&action=edit Bug 18633: Remove remaining use of CGI.param in template Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |18654 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18654 [Bug 18654] Translatability: Get rid of tt directives starting with [%% in translation for itemsearch.tt -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=16485 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64721|0 |1 is obsolete| | --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 64900 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64900&action=edit Bug 18633: Remove useless use of CGI TT plugin The form is sent using AJAX so there is never a query string in the URL (no POST parameters either) Tested both patches together, item search behaves as before, log entries are gone Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64722|0 |1 is obsolete| | --- Comment #14 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 64901 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64901&action=edit Bug 18633: Remove remaining use of CGI.param in template Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl Patch complexity|--- |Small patch QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #15 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to Master |Pushed to Stable --- Comment #16 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.05.x, will be in 17.05.02 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Doesn't apply cleanly on 16.11.x - please rebase! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #18 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 65502 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=65502&action=edit Bug 18633: Remove useless use of CGI TT plugin [16.11.x] The form is sent using AJAX so there is never a query string in the URL (no POST parameters either) Tested both patches together, item search behaves as before, log entries are gone Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #19 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 65503 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=65503&action=edit Bug 18633: Remove remaining use of CGI.param in template [16.11.x] Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #20 from M. Tompsett <mtompset@hotmail.com> --- I believe I have rebased this for 16.11.x correctly. However, I did not test. I probably should have removed the sign offs for the 16.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 --- Comment #21 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Mark, thx for the patches. I tested and it seems they break itemsearch on 16.11.x. Please take another look, if you can. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18633 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to Stable |RESOLVED --- Comment #22 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Closing. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org