Hello. Just a heads' up- the master branch on git.k-c.org is currently broken. I can't tell exactly when it broke, but it was sometime after the security patch that was pushed yesterday. The error message you get when you try to log in to the staff client is: Can't call method "cookie" on an undefined value at /home/jcamins/k ohaclone/C4/Templates.pm line 323 I don't have time to troubleshoot this, but I wanted to warn people of the problem before too many people updated their systems with catastrophic results (hopefully this will stave off a bit of the wailing and gnashing of teeth which would otherwise accompany the git pull at 9am Monday morning). Regards, Jared Camins-Esakov -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
99% probability that its the patch patch since that was around cookies. The good news it can be reverted out, since neither master or the 3.6.x branch were/are vulnerable. Only 3.4.6 and older were. So we can revert it back out with no issue. Thanks for the catch Jared, this will happen from time to time, mistakes happen (this time my fault), luckily not often I think twice in the last year. But master is the unstable branch, so it can happen, I recommend people use the stable branches in production Chris On 27 Nov 2011 10:19, "Jared Camins-Esakov" <jcamins@cpbibliography.com> wrote:
Hello.
Just a heads' up- the master branch on git.k-c.org is currently broken. I can't tell exactly when it broke, but it was sometime after the security patch that was pushed yesterday. The error message you get when you try to log in to the staff client is:
Can't call method "cookie" on an undefined value at /home/jcamins/k ohaclone/C4/Templates.pm line 323
I don't have time to troubleshoot this, but I wanted to warn people of the problem before too many people updated their systems with catastrophic results (hopefully this will stave off a bit of the wailing and gnashing of teeth which would otherwise accompany the git pull at 9am Monday morning).
Regards, Jared Camins-Esakov
-- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Hmmm I can't replicate this error on master, Can you tell me exactly how got it, I can logout and login just fine in both the opac and staff interface Chris On 27 November 2011 10:58, Chris Cormack <chris@bigballofwax.co.nz> wrote:
99% probability that its the patch patch since that was around cookies. The good news it can be reverted out, since neither master or the 3.6.x branch were/are vulnerable. Only 3.4.6 and older were.
So we can revert it back out with no issue.
Thanks for the catch Jared, this will happen from time to time, mistakes happen (this time my fault), luckily not often I think twice in the last year. But master is the unstable branch, so it can happen, I recommend people use the stable branches in production
Chris
On 27 Nov 2011 10:19, "Jared Camins-Esakov" <jcamins@cpbibliography.com> wrote:
Hello. Just a heads' up- the master branch on git.k-c.org is currently broken. I can't tell exactly when it broke, but it was sometime after the security patch that was pushed yesterday. The error message you get when you try to log in to the staff client is: Can't call method "cookie" on an undefined value at /home/jcamins/kohaclone/C4/Templates.pm line 323
I don't have time to troubleshoot this, but I wanted to warn people of the problem before too many people updated their systems with catastrophic results (hopefully this will stave off a bit of the wailing and gnashing of teeth which would otherwise accompany the git pull at 9am Monday morning). Regards, Jared Camins-Esakov -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
I was able to reproduce the problem, I think it's related to the web installer: URL: /cgi-bin/koha/installer/install.pl?step=3 Software error: Can't call method "cookie" on an undefined value at .../kohaclone/C4/Templates.pm line 323. -- Katrin -----Ursprüngliche Nachricht----- Von: koha-devel-bounces@lists.koha-community.org im Auftrag von Chris Cormack Gesendet: So 27.11.2011 07:06 An: Jared Camins-Esakov Cc: koha-devel@lists.koha-community.org Betreff: Re: [Koha-devel] Master broken Hmmm I can't replicate this error on master, Can you tell me exactly how got it, I can logout and login just fine in both the opac and staff interface Chris On 27 November 2011 10:58, Chris Cormack <chris@bigballofwax.co.nz> wrote:
99% probability that its the patch patch since that was around cookies. The good news it can be reverted out, since neither master or the 3.6.x branch were/are vulnerable. Only 3.4.6 and older were.
So we can revert it back out with no issue.
Thanks for the catch Jared, this will happen from time to time, mistakes happen (this time my fault), luckily not often I think twice in the last year. But master is the unstable branch, so it can happen, I recommend people use the stable branches in production
Chris
On 27 Nov 2011 10:19, "Jared Camins-Esakov" <jcamins@cpbibliography.com> wrote:
Hello. Just a heads' up- the master branch on git.k-c.org is currently broken. I can't tell exactly when it broke, but it was sometime after the security patch that was pushed yesterday. The error message you get when you try to log in to the staff client is: Can't call method "cookie" on an undefined value at /home/jcamins/kohaclone/C4/Templates.pm line 323
I don't have time to troubleshoot this, but I wanted to warn people of the problem before too many people updated their systems with catastrophic results (hopefully this will stave off a bit of the wailing and gnashing of teeth which would otherwise accompany the git pull at 9am Monday morning). Regards, Jared Camins-Esakov -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
On Sat, Nov 26, 2011 at 04:19:26PM -0500, Jared Camins-Esakov wrote:
Can't call method "cookie" on an undefined value at /home/jcamins/k ohaclone/C4/Templates.pm line 323
The patch (9a4e9e54f26b0c1bf69c5be1f5b0fea93134c06a / Bug 6629 : Sanitizing input from language cookie) has removed a conditional assignement to a simple assignement. C4/Templates.pm: - $lang = $query->cookie('KohaOpacLanguage') - if defined $query and $query->cookie('KohaOpacLanguage'); + $lang = getlanguagecookie($query); And as C4::Templates::getlanguagecookie deference $query for obtain cookie information... when $query is undef, not method to call. Has a bug report created ? The patch for 6629 as introduce a new bug... -- Frère Sébastien Marie Abbaye Notre Dame de La Trappe 61380 Soligny-la-Trappe Tél: 02.33.84.17.00 Fax: 02.33.34.98.57 Web: http://www.latrappe.fr/
2011/11/27 Frère Sébastien <semarie-koha@latrappe.fr>:
On Sat, Nov 26, 2011 at 04:19:26PM -0500, Jared Camins-Esakov wrote:
Can't call method "cookie" on an undefined value at /home/jcamins/k ohaclone/C4/Templates.pm line 323
The patch (9a4e9e54f26b0c1bf69c5be1f5b0fea93134c06a / Bug 6629 : Sanitizing input from language cookie) has removed a conditional assignement to a simple assignement.
C4/Templates.pm: - $lang = $query->cookie('KohaOpacLanguage') - if defined $query and $query->cookie('KohaOpacLanguage'); + $lang = getlanguagecookie($query);
And as C4::Templates::getlanguagecookie deference $query for obtain cookie information... when $query is undef, not method to call.
Has a bug report created ? The patch for 6629 as introduce a new bug... -- New patch on 6629, it turns out InstallAuth.pm had its own vulnerability that this error lead me to discover.
Patch addresses this error and fixes the vulnerability in the web installer Please test and sign off Chris
Le 27/11/2011 09:22, Chris Cormack a écrit :
Patch addresses this error and fixes the vulnerability in the web installer
Follow-up patch tested and pushed -- Paul POULAIN http://www.biblibre.com Expert en Logiciels Libres pour l'info-doc Tel : (33) 4 91 81 35 08
participants (5)
-
Chris Cormack -
Fischer, Katrin -
Frère Sébastien Marie -
Jared Camins-Esakov -
Paul Poulain