Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/C4
History
Jonathan Druart 94dde6b48d Bug 15809: Redefine multi_param is CGI < 4.08 is used 
On debian Jessie, the CGI version is >= 4.08
Since this version, the param method raise a warning
"CGI::param called in list context".
Indeed, it can cause vulnerability if called in list context

https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter
http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/

There is a long journey to get rid of these warnings.
First I suggest to redefine the multi_param method when the CGI version
 installed is < 4.08, it will allow us to move the wrong ->param calls to
 ->multi_param without waiting for everybody to upgrade.

The different ways to call these 2 methods are:

my $foo = $cgi->param('foo'); # OK

my @foo = $cgi->param('foo'); # NOK, will raise the warning
my @foo = $cgi->multi_param('foo'); #OK

$template->param( foo => $cgi->param('foo') ); # NOK, will raise the warning
                                               # and vulnerable
$template->param( foo => scalar $cgi->param('foo') ); # OK

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested a call to multi_param with CGI < 4.08.
With reference to the comments on Bugzilla, this workaround is arguable,
but provides a base to move to multi_param. If we come up with a better
solution, it should be easy to adjust.

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-03-22 23:23:39 +00:00
..
AuthoritiesMarc Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Barcodes Bug 15042: Barcode hbyymmincr does not work when receiving serials 2015-10-22 10:38:50 -03:00
Bookseller Bug 10402 follow-up: choose contacts for claims 2014-08-26 11:45:59 -03:00
ClassSortRoutine Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Creators Bug 14468: Remove warnings when creating Labels 2015-10-27 10:12:32 -03:00
External Bug 13758: Correct KOHA::VERSION in OverDrive.pm 2015-05-11 09:36:07 -03:00
Form Bug 15099: Move admin/categorie.pl to admin/categories.pl 2015-12-30 16:36:41 +00:00
Heading Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
ILSDI Bug 9809: Update AddReserve prototype to remove constraint parameter 2015-08-26 10:26:43 -03:00
Installer Bug 14168 - enhance streaming cataloging to include youtube 2016-03-02 00:40:00 +00:00
Labels Bug 14781: Creation of barcode types 2of5 not functional 2015-11-05 10:31:46 -03:00
Linker Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Members Bug 15163: Do not erase patron attributes if limited to another library 2016-03-21 16:56:37 +00:00
OAI Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Output Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Patroncards Bug 14107: Patron cards: Make barcode width and height scaling editable 2015-07-24 14:07:18 -03:00
Reports Bug 15800: Koha::AuthorisedValues - Remove C4::Koha::IsAuthorisedValueCategory 2016-03-02 03:54:16 +00:00
Search Bug 10933: (follow-up) fix the previous patch to work with master 2015-10-27 11:03:03 -03:00
Serials Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
SIP Bug 13871: [QA Follow-up] Add $server for FID_SCREEN_MSG 2016-03-07 17:22:21 +00:00
Utils Bug 15285: Update common files 2016-02-24 00:02:49 +00:00
Accounts.pm Bug 14402: Make purge_zero_balance_fees() delete fees with NULL balance. 2015-11-09 14:58:51 -03:00
Acquisition.pm Bug 5404: Move the test to a new IsMarcStructureInternal sub 2016-03-07 17:30:09 +00:00
Auth.pm Bug 4941: Remove the singleBranchMode system preference 2016-02-26 12:13:09 +00:00
Auth_cas_servers.yaml.orig Bug 5630 CAS improvements 2011-10-13 10:49:49 +13:00
Auth_with_cas.pm Bug 14121: Silence warnings t/db_dependent/Auth_with_cas.t 2015-07-20 10:32:21 -03:00
Auth_with_ldap.pm Bug 15163: Do not erase patron attributes if limited to another library 2016-03-21 16:56:37 +00:00
Auth_with_shibboleth.pm Bug 5010: Fix OPACBaseURL to include protocol 2015-06-04 10:00:04 -03:00
AuthoritiesMarc.pm Bug 15358: Fix authorities merge 2016-02-03 23:03:33 +00:00
BackgroundJob.pm Bug 13606 Clear job data in session when the job is completed 2015-04-23 13:18:48 -03:00
Barcodes.pm Bug 13813: Remove deprecated module C4::Dates from system 2015-09-18 12:40:55 -03:00
Biblio.pm Bug 15955: Tuning function 'New child record' for Unimarc 205$a -> 461$e 2016-03-11 21:55:24 +00:00
Bookseller.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Boolean.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Branch.pm Bug 15629: Koha::Libraries - Remove GetBranchInfo 2016-02-24 03:55:07 +00:00
Breeding.pm Bug 13987: Fix server name in z39.50 authority search results 2015-04-22 14:39:00 -03:00
Budgets.pm Bug 15084: Remove C4::Budgets::ConvertCurrency 2016-03-03 20:39:01 +00:00
Calendar.pm Bug 14954: Remove unused C4::Calendar::addDate subroutine 2015-11-17 23:44:57 -03:00
Category.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Charset.pm Bug 14078: (followup) converting from ISO5426 is not complete 2015-11-16 12:48:44 -03:00
Circulation.pm Bug 14694 - Make decreaseloanHighHolds more flexible 2016-03-07 17:48:51 +00:00
ClassSortRoutine.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
ClassSource.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Context.pm Bug 15809: Redefine multi_param is CGI < 4.08 is used 2016-03-22 23:23:39 +00:00
Contract.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
CourseReserves.pm Bug 15530 - Editing a course item via a disabled course disables it even if it is on other enabled courses 2016-01-27 00:58:14 +00:00
Creators.pm Bug 14059: Delete all export of get_column_names 2015-05-22 17:02:21 -03:00
Csv.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Debug.pm Bug 14870: (followup) Remove mention of C4::Dates from C4/Debug.pm 2015-11-19 13:05:06 -03:00
Heading.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
HoldsQueue.pm Bug 12803 [QA Followup] - Allow holiday caching to be disabled for testing purposes 2016-03-03 20:19:00 +00:00
HTML5Media.pm Bug 14168: (followup) require WWW::YouTube::Download only when syspref enabled 2016-03-03 18:47:03 +00:00
Images.pm Bug 14778: Install fixtures for t/Images.t 2015-10-23 12:01:18 -03:00
ImportBatch.pm Bug 14597: (QA followup) Make Logger package level 2015-09-28 12:20:49 -03:00
ImportExportFramework.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
InstallAuth.pm Bug 15005: Replace CGI->url with the corresponding url 2015-10-19 09:36:43 -03:00
Installer.pm Bug 11431: (QA followup) Make audio alerts sql top level 2015-11-04 12:33:53 -03:00
ItemCirculationAlertPreference.pm Bug 14828: Use Koha::ItemType[s] everywhere C4::ItemType was used 2016-01-27 20:46:58 +00:00
Items.pm Bug 5404: Move the test to a new IsMarcStructureInternal sub 2016-03-07 17:30:09 +00:00
Koha.pm Bug 5404: C4::Koha - remove subfield_is_koha_internal_p 2016-03-07 17:30:09 +00:00
Labels.pm Bug 8315 - remove use C4::* version 2012-07-13 14:17:20 +02:00
Languages.pm Bug 15719: Silence warning in C4/Language.pm during web install 2016-02-24 01:55:27 +00:00
Letters.pm Bug 12426: [QA Follow-up] Clear to_address to force update 2016-03-03 20:16:07 +00:00
Linker.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Log.pm Bug 15632 [QA Followup] - Get rid of use of uninitialized value errors for unit tests 2016-03-03 21:22:15 +00:00
MarcModificationTemplates.pm Bug 15669: Alphabetize marc modification templates 2016-03-03 22:11:44 +00:00
Matcher.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Members.pm Bug 15656: Move guarantor/guarantees code - GetMemberRelatives 2016-03-12 23:40:10 +00:00
Message.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
NewsChannels.pm Bug 14248: Optionally display authorship for news 2015-10-27 16:26:22 -03:00
Output.pm Bug 15111: Change X-Frame-Options with SAMEORIGIN 2016-03-14 16:30:08 +00:00
Overdues.pm Bug 15084: Replace C4::Budgets::GetCurrencies with Koha::Acquisition::Currencies->search 2016-03-03 20:39:01 +00:00
Patroncards.pm Bug 8315 - remove use C4::* version 2012-07-13 14:17:20 +02:00
Print.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Ratings.pm Bug 14383: Fix POD error in C4/Ratings.pm 2015-06-22 17:34:47 -03:00
Record.pm Bug 13642 - Adding new features for Dublin Core metadata 2016-01-27 06:23:07 +00:00
Reports.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Reserves.pm Bug 15629: Koha::Libraries - Remove GetBranchDetail 2016-02-24 03:55:06 +00:00
Review.pm Bug 13969: Replace calls to $sth->fetchrow* with a call to $dbh->selectrow* and Cleaning files 2015-05-14 11:11:41 -03:00
Ris.pm Bug 14971: fix RIS export 2015-12-11 16:28:27 +00:00
RotatingCollections.pm Bug 15066: Make transfer rotating collection works under Plack 2015-11-05 09:50:09 -03:00
Scheduler.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Scrubber.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Search.pm Bug 15694: Add aliases for date/time last modified 2016-03-11 21:56:50 +00:00
Serials.pm Bug 12375 [7] - Update to use Koha::Object classes 2015-12-31 12:29:05 +00:00
Service.pm Bug 11559: Supporting changes for Rancor 2015-10-27 12:16:05 -03:00
ShelfBrowser.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
SMS.pm Bug 14421: Corrected example in SMS.pm to working version with hashref. 2015-06-22 11:08:29 -03:00
SocialData.pm Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
Stats.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Suggestions.pm Bug 15090: Fix date filter for Suggestions management 2015-11-02 11:35:02 -03:00
Tags.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
Templates.pm Bug 15968: Unnecessary loop in C4::Templates 2016-03-07 17:20:00 +00:00
TmplToken.pm Bug 6679: (follow-up) fix 9 perlcritic violations in C4/TmplTokenType.pm 2016-01-27 05:06:23 +00:00
TmplTokenType.pm Bug 6679: (follow-up) fix 9 perlcritic violations in C4/TmplTokenType.pm 2016-01-27 05:06:23 +00:00
TTParser.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
UsageStats.pm Bug 4941: Remove the singleBranchMode system preference 2016-02-26 12:13:09 +00:00
XISBN.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
XSLT.pm Bug 4941 [QA Followup] - Retain singleBranchMode in list of sysprefs passed to XSLT 2016-02-26 12:24:04 +00:00