search

perfsonar / perl-shared

Shared libraries used by perl packages and referenced as a submodule in many git repos
Apache License 2.0
7 stars 3 forks source link

Try to use CGI::multi_param if available #36

Closed vvidic closed 7 years ago

vvidic commented 7 years ago

CGI::param called in list context from /usr/share/perl5/perfSONAR_PS/NPToolkit/WebService/Method.pm line 205, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 405.

apertome commented 7 years ago

@vvidic This PR breaks some functionality (particularly, saving Auto Updates/NTP servers. Maybe any save operation?

I see these errors

 [Wed May 31 20:16:24.771796 2017] [cgi:error] [pid 2234] [client 129.79.9.117:54513] AH01215: "my" variable $param masks earlier declaration in same scope at /home/mj82/src/toolkit/web-ng/root/admin/services/../../../../lib/perfSONAR_PS/NPToolkit/WebService/Method.pm line 200., referer: https://perfsonar-dev8.grnoc.iu.edu/toolkit/auth/admin/host.cgi
[Wed May 31 20:16:24.901225 2017] [cgi:error] [pid 2234] [client 129.79.9.117:54513] AH01215: Not a HASH reference at /home/mj82/src/toolkit/web-ng/root/admin/services/../../../../lib/perfSONAR_PS/NPToolkit/WebService/Method.pm line 203., referer: https://perfsonar-dev8.grnoc.iu.edu/toolkit/auth/admin/host.cgi
[Wed May 31 20:16:24.916645 2017] [cgi:error] [pid 2234] [client 129.79.9.117:54513] End of script output before headers: host.cgi, referer: https://perfsonar-dev8.grnoc.iu.edu/toolkit/auth/admin/host.cgi

It looks like there is already a $params variable defined; you attempt to create a second one, but it doesn't work.

I'm assuming you just wanted a whole new variable, not to modify the existing one -- but I'm not sure, so I think I'll kick it back to you to resolve.

vvidic commented 7 years ago

Updated the pull request, please check now.

apertome commented 7 years ago

Works fine now, thanks!