Runmode called: $current_runmode"
-+Query paramaters:
$query_params -+Your application has not specified any runmodes.
-+Please read the CGI::Application documentation.
-+ }; -+ return $output; -+} -+ -+ - sub header_add { - my $self = shift; - return $self->_header_props_update(\@_,add=>1); -@@ -513,7 +534,7 @@ sub run_modes { - my (@data) = (@_); - - # First use? Create new __RUN_MODES! -- $self->{__RUN_MODES} = { 'start' => 'dump_html' } unless (exists($self->{__RUN_MODES})); -+ $self->{__RUN_MODES} = { 'start' => 'no_runmodes' } unless (exists($self->{__RUN_MODES})); - - my $rr_m = $self->{__RUN_MODES}; - -@@ -1653,7 +1674,8 @@ Useful for outputting to STDERR. - The dump_html() method is a debugging function which will return - a chunk of text which contains all the environment and web form - data of the request, formatted nicely for human readability via --a web browser. Useful for outputting to a browser. -+a web browser. Useful for outputting to a browser. Please consider -+the security implications of using this in production code. - - =head3 error_mode() - Index: patches/patch-t_basic_t =================================================================== RCS file: patches/patch-t_basic_t diff -N patches/patch-t_basic_t --- patches/patch-t_basic_t 23 Jul 2014 20:06:13 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,51 +0,0 @@ -$OpenBSD: patch-t_basic_t,v 1.1 2014/07/23 20:06:13 naddy Exp $ -# CVE-2013-7329 -# https://github.com/markstos/CGI--Application/pull/15 ---- t/basic.t.orig Fri Jun 17 03:05:14 2011 -+++ t/basic.t Thu Jun 5 12:35:32 2014 -@@ -1,6 +1,6 @@ - - use strict; --use Test::More tests => 110; -+use Test::More tests => 112; - - BEGIN{use_ok('CGI::Application');} - -@@ -28,7 +28,7 @@ sub response_like { - } - - # Instantiate CGI::Application --# run() CGI::Application object. Expect header + output dump_html() -+# run() CGI::Application object. Expect header + output no_runmodes() - { - my $app = CGI::Application->new(); - isa_ok($app, 'CGI::Application'); -@@ -39,9 +39,27 @@ sub response_like { - response_like( - $app, - qr{^Content-Type: text/html}, -- qr/Query Environment:/, -+ qr/Error - No runmodes specified./, - 'base class response', - ); -+} -+ -+# Instantiate CGI::Application -+# run() CGI::Application sub-class. -+# Expect header + output dump_html() -+{ -+ -+ my $app = TestApp->new(); -+ $app->query(CGI->new({'test_rm' => 'dump_htm'})); -+ -+ response_like( -+ $app, -+ qr{^Content-Type: text/html}, -+ qr/Query Environment:/, -+ 'dump_html class response' -+ -+ ); -+ - } - - # Instantiate CGI::Application sub-class. Index: patches/patch-t_lib_TestApp_pm =================================================================== RCS file: patches/patch-t_lib_TestApp_pm diff -N patches/patch-t_lib_TestApp_pm --- patches/patch-t_lib_TestApp_pm 23 Jul 2014 20:06:13 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,13 +0,0 @@ -$OpenBSD: patch-t_lib_TestApp_pm,v 1.1 2014/07/23 20:06:13 naddy Exp $ -# CVE-2013-7329 -# https://github.com/markstos/CGI--Application/pull/15 ---- t/lib/TestApp.pm.orig Fri Jun 17 03:05:14 2011 -+++ t/lib/TestApp.pm Thu Jun 5 12:26:56 2014 -@@ -27,6 +27,7 @@ sub setup { - 'header_props_before_header_add' => \&header_props_before_header_add, - 'header_add_after_header_props' => \&header_add_after_header_props, - -+ 'dump_htm' => 'dump_html', - 'dump_txt' => 'dump', - 'eval_test' => 'eval_test', - ); Index: patches/patch-t_load_tmpl_hook_t =================================================================== RCS file: patches/patch-t_load_tmpl_hook_t diff -N patches/patch-t_load_tmpl_hook_t --- patches/patch-t_load_tmpl_hook_t 23 Jul 2014 20:06:13 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,14 +0,0 @@ -$OpenBSD: patch-t_load_tmpl_hook_t,v 1.1 2014/07/23 20:06:13 naddy Exp $ -# CVE-2013-7329 -# https://github.com/markstos/CGI--Application/pull/15 ---- t/load_tmpl_hook.t.orig Fri Jun 17 03:05:14 2011 -+++ t/load_tmpl_hook.t Thu Jun 5 12:26:56 2014 -@@ -8,7 +8,7 @@ $ENV{CGI_APP_RETURN_ONLY} = 1; - my $app = CGI::Application->new(); - my $out = $app->run; - --like($out, qr/start/, "normal app output contains start"); -+like($out, qr/Error - No runmodes specified/, "normal app output contains start"); - unlike($out, qr/load_tmpl_hook/, "normal app output doesn't contain load_tmpl_hook"); - - {