summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authormyk%mozilla.org <>2002-07-07 03:27:18 +0200
committermyk%mozilla.org <>2002-07-07 03:27:18 +0200
commit38fac1759c2ebcd108d5fa2dbc86d0b34e0f2951 (patch)
tree9c6a4f75d1aa1570bf6d2c89ea0fffcf99c29a65
parentef7c3883b5b4f8ef385f7d2d935c8ae3990e6249 (diff)
downloadbugzilla-38fac1759c2ebcd108d5fa2dbc86d0b34e0f2951.tar.gz
bugzilla-38fac1759c2ebcd108d5fa2dbc86d0b34e0f2951.tar.xz
Fix for bug 155700: detaints bug ID in ValidateBugID so it doesn't fail taint checks.
2rx=bbaetz
-rw-r--r--CGI.pl5
1 files changed, 3 insertions, 2 deletions
diff --git a/CGI.pl b/CGI.pl
index 8e8da5871..4eeeaf5d2 100644
--- a/CGI.pl
+++ b/CGI.pl
@@ -276,8 +276,9 @@ sub ValidateBugID {
$id = trim($id);
# If the ID isn't a number, it might be an alias, so try to convert it.
- if ($id !~ /^[1-9][0-9]*$/) {
- $id = BugAliasToID($id);
+ my $alias = $id;
+ if (!detaint_natural($id)) {
+ $id = BugAliasToID($alias);
if (!$id) {
my $html_id = html_quote($_[0]);
my $alias_specific_message = Param("usebugaliases") ?