Jeff King <p...@peff.net> writes:
> As of CGI.pm's 4.08 release, the behavior to call
> CGI::param() in a list context is deprecated (because it can
> be potentially unsafe if called inside a hash constructor).
> This cause gitweb to issue a warning for some of our code,
> which in turn causes the tests to fail.
>
> Our use is in fact _not_ one of the dangerous cases, as we
> are intentionally using a list context. The recommended
> route by 4.08 is to use the new CGI::multi_param() call to
> make it explicit that we know what we are doing.
> However, that function is only available in 4.08, which is
> about a month old; we cannot rely on having it.
>
> One option would be to set $CGI::LIST_CONTEXT_WARN globally,
> which turns off the warning. However, that would eliminate
> the protection these newer releases are trying to provide.
> We want to annotate each site as OK using the new function.
>
> So instead, let's check whether CGI provides the
> multi_param() function, and if not, provide an
> implementation that just wraps param(). That will work on
> both old and new versions of CGI. Sadly, we cannot just
> check defined(\&CGI::multi_param), because CGI uses the
> autoload feature, which claims that all functions are
> defined. Instead, we just do a version check.
The solution does look like the best in the messy situation. Thanks
for looking into it.
> +if (!defined($CGI::VERSION) || $CGI::VERSION < 4.08) {
> + eval 'sub CGI::multi_param { CGI::param(@_) }'
> +}
> +
> our $t0 = [ gettimeofday() ];
> our $number_of_git_cmds = 0;
>
> @@ -871,7 +875,7 @@ sub evaluate_query_params {
>
> while (my ($name, $symbol) = each %cgi_param_mapping) {
> if ($symbol eq 'opt') {
> - $input_params{$name} = [ map { decode_utf8($_) }
> $cgi->param($symbol) ];
> + $input_params{$name} = [ map { decode_utf8($_) }
> $cgi->multi_param($symbol) ];
> } else {
> $input_params{$name} =
> decode_utf8($cgi->param($symbol));
> }
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
