aboutsummaryrefslogtreecommitdiffstats
path: root/userprefs.cgi
diff options
context:
space:
mode:
authorFrédéric Buclin <LpSolit@gmail.com>2014-10-06 14:29:01 +0000
committerDavid Lawrence <dkl@mozilla.com>2014-10-06 14:29:01 +0000
commit9e186bdd5da79077f162351d61fd1163d6cfd622 (patch)
tree3ddcb53698d5f608dd9228b1632481f4a0fcc04f /userprefs.cgi
parent553568ddf8d9c6282daf779bb83dec7111ed4ff0 (diff)
downloadbugs-9e186bdd5da79077f162351d61fd1163d6cfd622.tar
bugs-9e186bdd5da79077f162351d61fd1163d6cfd622.tar.gz
bugs-9e186bdd5da79077f162351d61fd1163d6cfd622.tar.bz2
bugs-9e186bdd5da79077f162351d61fd1163d6cfd622.tar.xz
bugs-9e186bdd5da79077f162351d61fd1163d6cfd622.zip
Bug 1075578: [SECURITY] Improper filtering of CGI arguments
r=dkl,a=sgreen
Diffstat (limited to 'userprefs.cgi')
-rwxr-xr-xuserprefs.cgi2
1 files changed, 1 insertions, 1 deletions
diff --git a/userprefs.cgi b/userprefs.cgi
index ad5fb7d19..1f5f625f7 100755
--- a/userprefs.cgi
+++ b/userprefs.cgi
@@ -544,7 +544,7 @@ sub SaveApiKey {
if ($cgi->param('new_key')) {
$vars->{new_key} = Bugzilla::User::APIKey->create({
user_id => $user->id,
- description => $cgi->param('new_description'),
+ description => scalar $cgi->param('new_description'),
});
# As a security precaution, we always sent out an e-mail when