[libhtml-mason-perl] 01/03: Fix warnings with newer CGI.pm by applying patch from Kevin Falcone (Closes: #765477)

[dom at earth.li]

This is an automated email from the git hooks/post-receive script.

dom pushed a commit to branch master
in repository libhtml-mason-perl.

commit ba1f6f435bd17c6826a0790b433487038101cbd0
Author: Dominic Hargreaves <dom at earth.li>
Date:   Sun Oct 19 18:15:37 2014 +0100

    Fix warnings with newer CGI.pm by applying patch from Kevin Falcone (Closes: #765477)
---
 debian/changelog                                   |  4 +++
 ...03_cgi_param_disable_list_context_warning.patch | 39 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 44 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 597f5de..0b2f8b6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,6 +12,10 @@ libhtml-mason-perl (1:1.54-1) UNRELEASED; urgency=medium
   [ Salvatore Bonaccorso ]
   * Update Vcs-Browser URL to cgit web frontend
 
+  [ Dominic Hargreaves ]
+  * Fix warnings with newer CGI.pm by applying patch from
+    Kevin Falcone (Closes: #765477)
+
  -- Florian Schlichting <fsfs at debian.org>  Mon, 20 Jan 2014 22:26:21 +0100
 
 libhtml-mason-perl (1:1.52-1) unstable; urgency=low
diff --git a/debian/patches/03_cgi_param_disable_list_context_warning.patch b/debian/patches/03_cgi_param_disable_list_context_warning.patch
new file mode 100644
index 0000000..64e26ca
--- /dev/null
+++ b/debian/patches/03_cgi_param_disable_list_context_warning.patch
@@ -0,0 +1,39 @@
+From 0891bd1f51df3a76b083df9052092837c4f28fe7 Mon Sep 17 00:00:00 2001
+From: Kevin Falcone <falcone at bestpractical.com>
+Date: Wed, 15 Oct 2014 15:28:09 -0400
+Subject: [PATCH] Ask CGI to not warn about param() in list context.
+
+Mason protects from the class of param() bugs which allow users to sneak in
+arguments as described here:
+http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/
+
+Since CGI.pm 4.05 the only way to quiet this warning is by setting their
+variable as documented here
+https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter
+
+Mason has always allowed foo=1&foo=2 to end up available in a template
+as @foo = (1,2) so retain backcompat.
+
+Bug: https://rt.cpan.org/Public/Bug/Display.html?id=99520
+Origin: https://rt.cpan.org/Public/Bug/Display.html?id=99520
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765477
+
+---
+ lib/HTML/Mason/Utils.pm | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/HTML/Mason/Utils.pm b/lib/HTML/Mason/Utils.pm
+index ef9c5b8..c3e814e 100644
+--- a/lib/HTML/Mason/Utils.pm
++++ b/lib/HTML/Mason/Utils.pm
+@@ -42,6 +42,7 @@ sub cgi_request_args
+ 
+     foreach my $key ( map { $q->$_() } @methods ) {
+         next if exists $args{$key};
++        local $CGI::LIST_CONTEXT_WARN = 0;
+         my @values = map { $q->$_($key) } @methods;
+         $args{$key} = @values == 1 ? $values[0] : \@values;
+     }
+-- 
+1.9.3
+
diff --git a/debian/patches/series b/debian/patches/series
index 3378ff9..e7f24ce 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 01_apachehandler.patch
 02_cgihandler.patch
+03_cgi_param_disable_list_context_warning.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-perl/packages/libhtml-mason-perl.git