Too warning in Koha log " ... CGI::param called in list context from package main ..."
Hi to all, I have find a too high numbers of lines in Koha errors logs. All lines have: ... CGI::param called in list context from package main line xxx this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. I use Debian Jessie with Koha 3.20.7. CGI.pm version is 4.09, the jessie version: https://packages.debian.org/jessie/libcgi-pm-perl Reading this one: http://www.perlmonks.org/?node_id=1105164 and seeing this bugzilla: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076 I go to /usr/share/perl5/CGI.pm, line 28 and I change $LIST_CONTEXT_WARN = 1; into $LIST_CONTEXT_WARN = 0; Now no more warings in error logs. But I don't know: 1)Is present a better way that change a core lib code ? 2)What do we do about "CGI::param called in list context ... can lead to vulnerabilities" ? Bye Zeno Tajoli
and seeing this bugzilla: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076
I filed the similar Bug 15747: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15747 Not sure if it should be considered a duplicate? -- Owen -- Web Developer Athens County Public Libraries http://www.myacpl.org
Greetings, It isn't a duplicate, but the solution should be styled the same. The largest problem we have in this floody log battle is parameters are not documented as single or multiple value entities. There are some legit multiple value entries, I think the advanced search page has an example on it somewhere. The problem is you don't want to incorrectly identify a multi-value one as single-value. GPML, Mark Tompsett -----Original Message----- From: Owen Leonard Sent: Thursday, February 11, 2016 8:20 AM To: koha-devel@lists.koha-community.org Subject: Re: [Koha-devel] Too warning in Koha log " ... CGI::param called in list context from package main ..."
and seeing this bugzilla: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076
I filed the similar Bug 15747: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15747 Not sure if it should be considered a duplicate? -- Owen -- Web Developer Athens County Public Libraries http://www.myacpl.org _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
I have suggested a global solution on bug 15809, please have a look. See bug 14076 for a POC. 2016-02-11 8:35 GMT+00:00 Zeno Tajoli <z.tajoli@cineca.it>:
Hi to all,
I have find a too high numbers of lines in Koha errors logs. All lines have: ... CGI::param called in list context from package main line xxx this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
I use Debian Jessie with Koha 3.20.7. CGI.pm version is 4.09, the jessie version: https://packages.debian.org/jessie/libcgi-pm-perl
Reading this one: http://www.perlmonks.org/?node_id=1105164 and seeing this bugzilla: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14076
I go to /usr/share/perl5/CGI.pm, line 28 and I change
$LIST_CONTEXT_WARN = 1; into $LIST_CONTEXT_WARN = 0;
Now no more warings in error logs. But I don't know: 1)Is present a better way that change a core lib code ? 2)What do we do about "CGI::param called in list context ... can lead to vulnerabilities" ?
Bye Zeno Tajoli _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Hi Jonathan Il 12/02/2016 12:54, Jonathan Druart ha scritto:
I have suggested a global solution on bug 15809, please have a look. See bug 14076 for a POC.
why has the status "In discussion". Do you want sa evaluation about the solution ? For me it seem OK. I try to test it. Bye -- Zeno Tajoli / SVILUPPO PRODOTTI/ - Automazione Biblioteche Email: z.tajoli@cineca.it Fax: 051/6132198 *CINECA* Consorzio Interuniversitario - Sede operativa di Segrate (MI)
Yes, I would like to get feedbacks on this solution 2016-02-12 13:40 GMT+00:00 Tajoli Zeno <z.tajoli@cineca.it>:
Hi Jonathan
Il 12/02/2016 12:54, Jonathan Druart ha scritto:
I have suggested a global solution on bug 15809, please have a look. See bug 14076 for a POC.
why has the status "In discussion". Do you want sa evaluation about the solution ? For me it seem OK. I try to test it.
Bye
-- Zeno Tajoli / SVILUPPO PRODOTTI/ - Automazione Biblioteche Email: z.tajoli@cineca.it Fax: 051/6132198 *CINECA* Consorzio Interuniversitario - Sede operativa di Segrate (MI)
Greetings, My only concern is aging code. In the mean time, I think it is totally functional as a nice quick fix. Additionally, as we patch these params with multi_params, perhaps we should better document paths of execution to evaluate whether it really is a multi_param or just a param. And if we need that single value in an array for some reason, why not: my @foobars; my $foobar = $query->param('foobar') // q{}; push @foobars, $foobar; This is clear that the foobar param is scalar, and only pushes a clean value into the foobars array. GPML, Mark Tompsett
participants (5)
-
Jonathan Druart -
Mark Tompsett -
Owen Leonard -
Tajoli Zeno -
Zeno Tajoli