diff options
| author | Dylan William Hardison <dylan@hardison.net> | 2018-03-20 15:06:20 +0100 |
|---|---|---|
| committer | Dylan William Hardison <dylan@hardison.net> | 2018-03-20 15:06:20 +0100 |
| commit | 40023c4a9f7d949f623b3b6fa90c9cbf5dfc2351 (patch) | |
| tree | 8b712354b3cc527db6c498d11a50cdbbc2a42837 /.htaccess | |
| parent | 4cd99a91ff6a92a5e10449463b12a312060d01ba (diff) | |
| download | bugzilla-40023c4a9f7d949f623b3b6fa90c9cbf5dfc2351.tar.gz bugzilla-40023c4a9f7d949f623b3b6fa90c9cbf5dfc2351.tar.xz | |
Bug 1444008 - Form action injection in Bugzilla /user_profile (leads to XSS/single-factor credential leakage)
Diffstat (limited to '.htaccess')
| -rw-r--r-- | .htaccess | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -37,9 +37,9 @@ RewriteRule ^new[-_]bug$ new_bug.cgi [L,QSA] RewriteRule ^template_cache/ - [F,L,NC] RewriteRule ^template_cache.deleteme/ - [F,L,NC] -RewriteRule ^review(.*) page.cgi?id=splinter.html$1 [QSA] -RewriteRule ^user_?profile(.*) page.cgi?id=user_profile.html$1 [QSA] -RewriteRule ^request_defer(.*) page.cgi?id=request_defer.html$1 [QSA] +RewriteRule ^review$ page.cgi?id=splinter.html$1 [QSA] +RewriteRule ^user_?profile$ page.cgi?id=user_profile.html$1 [QSA] +RewriteRule ^request_defer$ page.cgi?id=request_defer.html$1 [QSA] RewriteRule ^favicon\.ico$ extensions/BMO/web/images/favicon.ico RewriteRule ^form[\.:]itrequest$ enter_bug.cgi?product=Infrastructure+\%26+Operations&format=itrequest [QSA] RewriteRule ^form[\.:](mozlist|poweredby|presentation|trademark|recoverykey)$ enter_bug.cgi?product=mozilla.org&format=$1 [QSA] |