[libhtml-mason-perl] 01/03: Fix warnings with newer CGI.pm by applying patch from Kevin Falcone (Closes: #765477)
dom at earth.li
dom at earth.li
Sun Oct 19 20:09:32 UTC 2014
This is an automated email from the git hooks/post-receive script.
dom pushed a commit to branch master
in repository libhtml-mason-perl.
commit ba1f6f435bd17c6826a0790b433487038101cbd0
Author: Dominic Hargreaves <dom at earth.li>
Date: Sun Oct 19 18:15:37 2014 +0100
Fix warnings with newer CGI.pm by applying patch from Kevin Falcone (Closes: #765477)
---
debian/changelog | 4 +++
...03_cgi_param_disable_list_context_warning.patch | 39 ++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 44 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 597f5de..0b2f8b6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,6 +12,10 @@ libhtml-mason-perl (1:1.54-1) UNRELEASED; urgency=medium
[ Salvatore Bonaccorso ]
* Update Vcs-Browser URL to cgit web frontend
+ [ Dominic Hargreaves ]
+ * Fix warnings with newer CGI.pm by applying patch from
+ Kevin Falcone (Closes: #765477)
+
-- Florian Schlichting <fsfs at debian.org> Mon, 20 Jan 2014 22:26:21 +0100
libhtml-mason-perl (1:1.52-1) unstable; urgency=low
diff --git a/debian/patches/03_cgi_param_disable_list_context_warning.patch b/debian/patches/03_cgi_param_disable_list_context_warning.patch
new file mode 100644
index 0000000..64e26ca
--- /dev/null
+++ b/debian/patches/03_cgi_param_disable_list_context_warning.patch
@@ -0,0 +1,39 @@
+From 0891bd1f51df3a76b083df9052092837c4f28fe7 Mon Sep 17 00:00:00 2001
+From: Kevin Falcone <falcone at bestpractical.com>
+Date: Wed, 15 Oct 2014 15:28:09 -0400
+Subject: [PATCH] Ask CGI to not warn about param() in list context.
+
+Mason protects from the class of param() bugs which allow users to sneak in
+arguments as described here:
+http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/
+
+Since CGI.pm 4.05 the only way to quiet this warning is by setting their
+variable as documented here
+https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter
+
+Mason has always allowed foo=1&foo=2 to end up available in a template
+as @foo = (1,2) so retain backcompat.
+
+Bug: https://rt.cpan.org/Public/Bug/Display.html?id=99520
+Origin: https://rt.cpan.org/Public/Bug/Display.html?id=99520
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765477
+
+---
+ lib/HTML/Mason/Utils.pm | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/HTML/Mason/Utils.pm b/lib/HTML/Mason/Utils.pm
+index ef9c5b8..c3e814e 100644
+--- a/lib/HTML/Mason/Utils.pm
++++ b/lib/HTML/Mason/Utils.pm
+@@ -42,6 +42,7 @@ sub cgi_request_args
+
+ foreach my $key ( map { $q->$_() } @methods ) {
+ next if exists $args{$key};
++ local $CGI::LIST_CONTEXT_WARN = 0;
+ my @values = map { $q->$_($key) } @methods;
+ $args{$key} = @values == 1 ? $values[0] : \@values;
+ }
+--
+1.9.3
+
diff --git a/debian/patches/series b/debian/patches/series
index 3378ff9..e7f24ce 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
01_apachehandler.patch
02_cgihandler.patch
+03_cgi_param_disable_list_context_warning.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-perl/packages/libhtml-mason-perl.git
More information about the Pkg-perl-cvs-commits
mailing list