aboutsummaryrefslogtreecommitdiffstats
path: root/process_bug.cgi
diff options
context:
space:
mode:
authorbbaetz%student.usyd.edu.au <>2002-01-22 23:12:11 +0000
committerbbaetz%student.usyd.edu.au <>2002-01-22 23:12:11 +0000
commit4c07cc48093b6233be5298606f87b82a64f54768 (patch)
tree3079847595ffa994988b22931d84246cfab576a7 /process_bug.cgi
parent8e2dfa5ab6404088b65f14b0e3f39362a0b5967d (diff)
downloadbugs-4c07cc48093b6233be5298606f87b82a64f54768.tar
bugs-4c07cc48093b6233be5298606f87b82a64f54768.tar.gz
bugs-4c07cc48093b6233be5298606f87b82a64f54768.tar.bz2
bugs-4c07cc48093b6233be5298606f87b82a64f54768.tar.xz
bugs-4c07cc48093b6233be5298606f87b82a64f54768.zip
Bug 121074 - taint error after changing bug
r=daa@distributed.net,jake
Diffstat (limited to 'process_bug.cgi')
-rwxr-xr-xprocess_bug.cgi26
1 files changed, 12 insertions, 14 deletions
diff --git a/process_bug.cgi b/process_bug.cgi
index 13942ca5f..dcde93035 100755
--- a/process_bug.cgi
+++ b/process_bug.cgi
@@ -92,20 +92,6 @@ if (defined $::FORM{'dup_id'} && $::FORM{'knob'} eq "duplicate") {
DuplicateUserConfirm();
}
-# If the user has a bug list and is processing one bug, then after
-# we process the bug we are going to show them the next bug on their
-# list. Thus we have to make sure this bug ID is also valid,
-# since a malicious cracker might alter their cookies for the purpose
-# gaining access to bugs they are not authorized to access.
-if ( defined $::COOKIE{"BUGLIST"} && defined $::FORM{'id'} ) {
- my @buglist = split( /:/ , $::COOKIE{"BUGLIST"} );
- my $idx = lsearch( \@buglist , $::FORM{"id"} );
- if ($idx < $#buglist) {
- my $nextbugid = $buglist[$idx + 1];
- ValidateBugID($nextbugid);
- }
-}
-
######################################################################
# End Data/Security Validation
######################################################################
@@ -484,6 +470,18 @@ if ($action eq Param("move-button-text")) {
print "<TITLE>Update Bug " . join(" ", @idlist) . "</TITLE>\n";
if (defined $::FORM{'id'}) {
navigation_header();
+ if (defined $::next_bug) {
+ # If there is another bug, then we're going to display it,
+ # so check that its a legal bug
+ # We need to check that its a number first
+ if (!(detaint_natural($::next_bug) && CanSeeBug($::next_bug))) {
+ # This isn't OK
+ # Rather than error out (which could validly happen if there
+ # was a bug in the list whose group was changed in the meantime)
+ # just remove references to it
+ undef $::next_bug;
+ }
+ }
}
print "<HR>\n";
$::query = "update bugs\nset";