Bug 1089448: Strawberry Perl throws a "Insecure dependency in sysopen" error when attaching a file

r=gerv a=dkl

1 files changed, 8 insertions, 0 deletions

diff --git a/Bugzilla.pm b/Bugzilla.pm
index e3184fdb8..3f4d31101 100644
--- a/Bugzilla.pm
+++ b/Bugzilla.pm
@@ -87,6 +87,14 @@ sub init_page {
         # Some modules throw undefined errors (notably File::Spec::Win32) if
         # PATH is undefined.
         $ENV{'PATH'} = '';
+        # On Windows, these paths are tainted, preventing File::Spec::Win32->tmpdir
+        # from using them. But we need a place to temporary store attachments
+        # which are uploaded.
+        if (ON_WINDOWS) {
+            foreach my $temp (qw(TMPDIR TMP TEMP)) {
+                trick_taint($ENV{$temp}) if $ENV{$temp};
+            }
+        }
     }
 
     # Because this function is run live from perl "use" commands of