Bug 1088022 - Bump min version to CGI 4.09 · gzgithub/bugzilla@90d86a9 · GitHub
Skip to content

Commit 90d86a9

Browse files
LpSolitLpSolit
committed
Bug 1088022 - Bump min version to CGI 4.09
r=dkl
1 parent ae22da8 commit 90d86a9

54 files changed

Lines changed: 240 additions & 284 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Bugzilla/Attachment.pm‎

Lines changed: 1 addition & 1 deletion

‎Bugzilla/CGI.pm‎

Lines changed: 20 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ use Bugzilla::Error;
1818
use Bugzilla::Util;
1919
use Bugzilla::Hook;
2020
use Bugzilla::Search::Recent;
21+
use Bugzilla::Install::Util qw(i_am_persistent);
2122

2223
use File::Basename;
2324

@@ -34,8 +35,7 @@ sub _init_bz_cgi_globals {
3435

3536
# We don't precompile any functions here, that's done specially in
3637
# mod_perl code.
37-
$invocant->_setup_symbols(qw(:no_xhtml :oldstyle_urls :private_tempfiles
38-
:unique_headers));
38+
$invocant->_setup_symbols(qw(:no_xhtml :oldstyle_urls :unique_headers :utf8));
3939
}
4040

4141
BEGIN { __PACKAGE__->_init_bz_cgi_globals() if i_am_cgi(); }
@@ -44,9 +44,7 @@ sub new {
4444
my ($invocant, @args) = @_;
4545
my $class = ref($invocant) || $invocant;
4646

47-
# Under mod_perl, CGI's global variables get reset on each request,
48-
# so we need to set them up again every time.
49-
$class->_init_bz_cgi_globals() if $ENV{MOD_PERL};
47+
$class->_init_bz_cgi_globals() if i_am_persistent();
5048

5149
my $self = $class->SUPER::new(@args);
5250

@@ -65,18 +63,11 @@ sub new {
6563
# Path-Info is of no use for Bugzilla and interacts badly with IIS.
6664
# Moreover, it causes unexpected behaviors, such as totally breaking
6765
# the rendering of pages.
68-
if (my $path_info = $self->path_info) {
66+
if ($self->script_name && $self->path_info) {
6967
my @whitelist = ("rest.cgi");
7068
Bugzilla::Hook::process('path_info_whitelist', { whitelist => \@whitelist });
7169
if (!grep($_ eq $script, @whitelist)) {
72-
# IIS includes the full path to the script in PATH_INFO,
73-
# so we have to extract the real PATH_INFO from it,
74-
# else we will be redirected outside Bugzilla.
75-
my $script_name = $self->script_name;
76-
$path_info =~ s/^\Q$script_name\E//;
77-
if ($script_name && $path_info) {
78-
print $self->redirect($self->url(-path => 0, -query => 1));
79-
}
70+
print $self->redirect($self->url(-path => 0, -query => 1));
8071
}
8172
}
8273

@@ -117,7 +108,7 @@ sub canonicalise_query {
117108

118109
# Reconstruct the URL by concatenating the sorted param=value pairs
119110
my @parameters;
120-
foreach my $key (sort($self->param())) {
111+
foreach my $key (sort($self->multi_param())) {
121112
# Leave this key out if it's in the exclude list
122113
next if grep { $_ eq $key } @exclude;
123114

@@ -127,7 +118,7 @@ sub canonicalise_query {
127118

128119
my $esc_key = url_quote($key);
129120

130-
foreach my $value ($self->param($key)) {
121+
foreach my $value ($self->multi_param($key)) {
131122
# Omit params with an empty value
132123
if (defined($value) && $value ne '') {
133124
my $esc_value = url_quote($value);
@@ -143,7 +134,7 @@ sub canonicalise_query {
143134
sub clean_search_url {
144135
my $self = shift;
145136
# Delete any empty URL parameter.
146-
my @cgi_params = $self->param;
137+
my @cgi_params = $self->multi_param();
147138

148139
foreach my $param (@cgi_params) {
149140
if (defined $self->param($param) && $self->param($param) eq '') {
@@ -252,23 +243,12 @@ sub check_etag {
252243
# Have to add the cookies in.
253244
sub multipart_start {
254245
my $self = shift;
255-
256-
my %args = @_;
257-
258-
# CGI.pm::multipart_start doesn't honour its own charset information, so
259-
# we do it ourselves here
260-
if (defined $self->charset() && defined $args{-type}) {
261-
# Remove any existing charset specifier
262-
$args{-type} =~ s/;.*$//;
263-
# and add the specified one
264-
$args{-type} .= '; charset=' . $self->charset();
265-
}
266-
267-
my $headers = $self->SUPER::multipart_start(%args);
246+
# We have to explicitly pass the charset.
247+
my $headers = $self->SUPER::multipart_start(@_, -charset => $self->charset());
268248
# Eliminate the one extra CRLF at the end.
269249
$headers =~ s/$CGI::CRLF$//;
270250
# Add the cookies. We have to do it this way instead of
271-
# passing them to multpart_start, because CGI.pm's multipart_start
251+
# passing them to multipart_start, because CGI.pm's multipart_start
272252
# doesn't understand a '-cookie' argument pointing to an arrayref.
273253
foreach my $cookie (@{$self->{Bugzilla_cookie_list}}) {
274254
$headers .= "Set-Cookie: ${cookie}${CGI::CRLF}";
@@ -366,11 +346,15 @@ sub header {
366346

367347
sub param {
368348
my $self = shift;
369-
local $CGI::LIST_CONTEXT_WARN = 0;
349+
350+
my @caller = caller(0);
351+
if (wantarray && $caller[0] ne 'CGI') {
352+
warn 'Illegal call to $cgi->param in list context from ' . $caller[0];
353+
}
370354

371355
# When we are just requesting the value of a parameter...
372356
if (scalar(@_) == 1) {
373-
my @result = $self->SUPER::param(@_);
357+
my @result = $self->SUPER::multi_param(@_);
374358

375359
# Also look at the URL parameters, after we look at the POST
376360
# parameters. This is to allow things like login-form submissions
@@ -381,9 +365,6 @@ sub param {
381365
@result = $self->url_param(@_);
382366
}
383367

384-
# Fix UTF-8-ness of input parameters.
385-
@result = map { _fix_utf8($_) } @result;
386-
387368
return wantarray ? @result : $result[0];
388369
}
389370
# And for various other functions in CGI.pm, we need to correctly
@@ -392,13 +373,13 @@ sub param {
392373
elsif (!scalar(@_) && $self->request_method
393374
&& $self->request_method eq 'POST')
394375
{
395-
my @post_params = $self->SUPER::param;
376+
my @post_params = $self->SUPER::multi_param();
396377
my @url_params = $self->url_param;
397378
my %params = map { $_ => 1 } (@post_params, @url_params);
398379
return keys %params;
399380
}
400381

401-
return $self->SUPER::param(@_);
382+
return $self->SUPER::multi_param(@_);
402383
}
403384

404385
sub url_param {
@@ -409,13 +390,6 @@ sub url_param {
409390
return $self->SUPER::url_param(@_);
410391
}
411392

412-
sub _fix_utf8 {
413-
my $input = shift;
414-
# The is_utf8 is here in case CGI gets smart about utf8 someday.
415-
utf8::decode($input) if defined $input && !ref $input && !utf8::is_utf8($input);
416-
return $input;
417-
}
418-
419393
sub should_set {
420394
my ($self, $param) = @_;
421395
my $set = (defined $self->param($param)
@@ -609,21 +583,12 @@ sub STORE {
609583
sub FETCH {
610584
my ($self, $param) = @_;
611585
return $self if $param eq 'CGI'; # CGI.pm did this, so we do too.
612-
my @result = $self->param($param);
586+
my @result = $self->multi_param($param);
613587
return undef if !scalar(@result);
614588
return $result[0] if scalar(@result) == 1;
615589
return \@result;
616590
}
617591

618-
# For the Vars TIEHASH interface: the normal CGI.pm DELETE doesn't return
619-
# the value deleted, but Perl's "delete" expects that value.
620-
sub DELETE {
621-
my ($self, $param) = @_;
622-
my $value = $self->FETCH($param);
623-
$self->delete($param);
624-
return $value;
625-
}
626-
627592
1;
628593

629594
__END__

‎Bugzilla/Chart.pm‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,10 @@ sub init {
5757
# &select0=1&select3=1...
5858
# &cumulate=1&datefrom=2002-02-03&dateto=2002-04-04&ctype=html...
5959
# &gt=1&labelgt=Grand+Total
60-
foreach my $param ($cgi->param()) {
60+
foreach my $param ($cgi->multi_param()) {
6161
# Store all the lines
6262
if ($param =~ /^line(\d+)$/a) {
63-
foreach my $series_id ($cgi->param($param)) {
63+
foreach my $series_id ($cgi->multi_param($param)) {
6464
detaint_natural($series_id)
6565
|| ThrowCodeError("invalid_series_id");
6666
my $series = new Bugzilla::Series($series_id);

‎Bugzilla/Flag.pm‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -843,11 +843,11 @@ sub extract_flags_from_cgi {
843843
}
844844

845845
# Extract a list of flag type IDs from field names.
846-
my @flagtype_ids = map(/^flag_type-(\d+)$/a ? $1 : (), $cgi->param());
846+
my @flagtype_ids = map { /^flag_type-(\d+)$/a ? $1 : () } $cgi->multi_param();
847847
@flagtype_ids = grep($cgi->param("flag_type-$_") ne 'X', @flagtype_ids);
848848

849849
# Extract a list of existing flag IDs.
850-
my @flag_ids = map(/^flag-(\d+)$/a ? $1 : (), $cgi->param());
850+
my @flag_ids = map { /^flag-(\d+)$/a ? $1 : () } $cgi->multi_param();
851851

852852
return ([], []) unless (scalar(@flagtype_ids) || scalar(@flag_ids));
853853

@@ -863,7 +863,7 @@ sub extract_flags_from_cgi {
863863
# (i.e. they want more than one person to set the flag) we can reuse
864864
# the existing flag for the first person (who may well be the existing
865865
# requestee), but we have to create new flags for each additional requestee.
866-
my @requestees = $cgi->param("requestee-$flag_id");
866+
my @requestees = $cgi->multi_param("requestee-$flag_id");
867867
my $requestee_email;
868868
if ($status eq "?"
869869
&& scalar(@requestees) > 1
@@ -935,7 +935,7 @@ sub extract_flags_from_cgi {
935935
my $status = $cgi->param("flag_type-$type_id");
936936
trick_taint($status);
937937

938-
my @logins = $cgi->param("requestee_type-$type_id");
938+
my @logins = $cgi->multi_param("requestee_type-$type_id");
939939
if ($status eq "?" && scalar(@logins)) {
940940
foreach my $login (@logins) {
941941
push (@new_flags, { type_id => $type_id,
@@ -986,7 +986,7 @@ sub multi_extract_flags_from_cgi {
986986
}
987987

988988
# Extract a list of flag type IDs from field names.
989-
my @flagtype_ids = map(/^flag_type-(\d+)$/a ? $1 : (), $cgi->param());
989+
my @flagtype_ids = map { /^flag_type-(\d+)$/a ? $1 : () } $cgi->multi_param();
990990

991991
my (@new_flags, @flags);
992992

@@ -1027,7 +1027,7 @@ sub multi_extract_flags_from_cgi {
10271027
my $status = $cgi->param("flag_type-$type_id");
10281028
trick_taint($status);
10291029

1030-
my @logins = $cgi->param("requestee_type-$type_id");
1030+
my @logins = $cgi->multi_param("requestee_type-$type_id");
10311031
if ($status eq "?" && scalar(@logins)) {
10321032
foreach my $login (@logins) {
10331033
if ($update) {

‎Bugzilla/Search/Quicksearch.pm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,7 @@ sub quicksearch {
248248
}
249249

250250
# Make sure we have some query terms left
251-
scalar($cgi->param())>0 || ThrowUserError("buglist_parameters_required");
251+
scalar $cgi->multi_param() or ThrowUserError("buglist_parameters_required");
252252
}
253253

254254
# List of quicksearch-specific CGI parameters to get rid of.

‎Bugzilla/Search/Saved.pm‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -220,10 +220,10 @@ sub edit_link {
220220
my ($self) = @_;
221221
return $self->{edit_link} if defined $self->{edit_link};
222222
my $cgi = new Bugzilla::CGI($self->url);
223-
if (!$cgi->param('query_type')
224-
|| !IsValidQueryType($cgi->param('query_type')))
223+
if (!$cgi->param('query_format')
224+
|| !IsValidQueryType(scalar $cgi->param('query_format')))
225225
{
226-
$cgi->param('query_type', 'advanced');
226+
$cgi->param('query_format', 'advanced');
227227
}
228228
$self->{edit_link} = $cgi->canonicalise_query;
229229
return $self->{edit_link};

‎Bugzilla/Template.pm‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1013,6 +1013,10 @@ sub create {
10131013
# If an sudo session is in progress, this is the user we're faking
10141014
'user' => sub { return Bugzilla->user; },
10151015

1016+
# TT directives are evaluated in list context, conflicting
1017+
# with CGI checks about using $cgi->param() in list context.
1018+
'cgi_param' => sub { return scalar Bugzilla->cgi->param($_[0]) },
1019+
10161020
# Currenly active language
10171021
'current_language' => sub { return Bugzilla->current_language; },
10181022

‎Makefile.PL‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ END {
4545

4646
# PREREQ_PM
4747
my %requires = (
48-
'CGI' => '3.51',
48+
'CGI' => '4.09',
4949
'DBI' => '1.614',
5050
'Date::Format' => '2.23',
5151
'DateTime' => '0.75',

‎attachment.cgi‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -330,8 +330,8 @@ sub view {
330330

331331
# Bug 111522: allow overriding content-type manually in the posted form
332332
# params.
333-
if (defined $cgi->param('content_type')) {
334-
$contenttype = $attachment->_check_content_type($cgi->param('content_type'));
333+
if (my $content_type = $cgi->param('content_type')) {
334+
$contenttype = $attachment->_check_content_type($content_type);
335335
}
336336

337337
# Return the appropriate HTTP response headers.
@@ -503,13 +503,13 @@ sub insert {
503503
my ($timestamp) = $dbh->selectrow_array("SELECT NOW()");
504504

505505
# Detect if the user already used the same form to submit an attachment
506-
my $token = trim($cgi->param('token'));
506+
my $token = trim(scalar $cgi->param('token'));
507507
check_token_data($token, 'create_attachment', 'index.cgi');
508508

509509
# Check attachments the user tries to mark as obsolete.
510510
my @obsolete_attachments;
511511
if ($cgi->param('obsolete')) {
512-
my @obsolete = $cgi->param('obsolete');
512+
my @obsolete = $cgi->multi_param('obsolete');
513513
@obsolete_attachments = Bugzilla::Attachment->validate_obsolete($bug, \@obsolete);
514514
}
515515

@@ -784,7 +784,7 @@ sub delete_attachment {
784784
$attachment->datasize || ThrowUserError('attachment_removed');
785785

786786
# We don't want to let a malicious URL accidentally delete an attachment.
787-
my $token = trim($cgi->param('token'));
787+
my $token = trim(scalar $cgi->param('token'));
788788
if ($token) {
789789
my ($creator_id, $date, $event) = Bugzilla::Token::GetTokenData($token);
790790
unless ($creator_id

‎buglist.cgi‎

Lines changed: 3 additions & 4 deletions

0 commit comments

Comments
 (0)