diff options
| author | bbaetz%student.usyd.edu.au <> | 2002-08-13 13:54:35 +0000 |
|---|---|---|
| committer | bbaetz%student.usyd.edu.au <> | 2002-08-13 13:54:35 +0000 |
| commit | 9b22dcde525cb7e0b0b88b80d627e7e1d3dd5e6c (patch) | |
| tree | 5ad90a3800a05fbfc2cecb0c5f5f4dba396d852d /userprefs.cgi | |
| parent | ebdbe669e45bfbfecb7330475a878583e09763ca (diff) | |
| download | bugs-9b22dcde525cb7e0b0b88b80d627e7e1d3dd5e6c.tar bugs-9b22dcde525cb7e0b0b88b80d627e7e1d3dd5e6c.tar.gz bugs-9b22dcde525cb7e0b0b88b80d627e7e1d3dd5e6c.tar.bz2 bugs-9b22dcde525cb7e0b0b88b80d627e7e1d3dd5e6c.tar.xz bugs-9b22dcde525cb7e0b0b88b80d627e7e1d3dd5e6c.zip | |
Bug 160710 - Taint checking causes problem with rename function
r=joel, preed
Diffstat (limited to 'userprefs.cgi')
| -rwxr-xr-x | userprefs.cgi | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/userprefs.cgi b/userprefs.cgi index 84c8ea027..cf58cf265 100755 --- a/userprefs.cgi +++ b/userprefs.cgi @@ -370,6 +370,9 @@ $vars->{'changes_saved'} = $::FORM{'dosave'}; my $current_tab_name = $::FORM{'tab'} || "account"; +# The SWITCH below makes sure that this is valid +trick_taint($current_tab_name); + $vars->{'current_tab_name'} = $current_tab_name; # Do any saving, and then display the current tab. @@ -393,6 +396,8 @@ SWITCH: for ($current_tab_name) { DoPermissions(); last SWITCH; }; + ThrowUserError("Unknown tab <code>" . html_quote($current_tab_name) + . "</code>"); } # Generate and return the UI (HTML page) from the appropriate template. |