summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorReed Loden <reed@reedloden.com>2010-02-01 22:27:08 +0100
committerMax Kanat-Alexander <mkanat@bugzilla.org>2010-02-01 22:27:08 +0100
commit9a80c1fffa48ef6d9301ba64a9bd02b4d5448dc2 (patch)
tree17ce8bffc3fe6534ba4a38aa4c186ff0349f7dc5
parent532196b8689286cf4e65b58c98afa95ca910d7ac (diff)
downloadbugzilla-9a80c1fffa48ef6d9301ba64a9bd02b4d5448dc2.tar.gz
bugzilla-9a80c1fffa48ef6d9301ba64a9bd02b4d5448dc2.tar.xz
Bug 434801: [SECURITY] .htaccess doesn't prevent reading old-params.txt from the web
Patch by Reed Loden <reed@reedloden.com> r=mkanat a=LpSolit
-rw-r--r--Bugzilla/Config.pm11
-rw-r--r--Bugzilla/Install/Filesystem.pm7
2 files changed, 14 insertions, 4 deletions
diff --git a/Bugzilla/Config.pm b/Bugzilla/Config.pm
index 0361592bf..a7184866f 100644
--- a/Bugzilla/Config.pm
+++ b/Bugzilla/Config.pm
@@ -221,7 +221,7 @@ sub update_params {
# --- REMOVE OLD PARAMS ---
my %oldparams;
- # Remove any old params, put them in old-params.txt
+ # Remove any old params
foreach my $item (keys %$param) {
if (!grep($_ eq $item, map ($_->{'name'}, @param_list))) {
$oldparams{$item} = $param->{$item};
@@ -229,13 +229,16 @@ sub update_params {
}
}
+ # Write any old parameters to old-params.txt
+ my $datadir = bz_locations()->{'datadir'};
+ my $old_param_file = "$datadir/old-params.txt";
if (scalar(keys %oldparams)) {
- my $op_file = new IO::File('old-params.txt', '>>', 0600)
- || die "old-params.txt: $!";
+ my $op_file = new IO::File($old_param_file, '>>', 0600)
+ || die "Couldn't create $old_param_file: $!";
print "The following parameters are no longer used in Bugzilla,",
" and so have been\nmoved from your parameters file into",
- " old-params.txt:\n";
+ " $old_param_file:\n";
local $Data::Dumper::Terse = 1;
local $Data::Dumper::Indent = 0;
diff --git a/Bugzilla/Install/Filesystem.pm b/Bugzilla/Install/Filesystem.pm
index 99f71d989..44c34718e 100644
--- a/Bugzilla/Install/Filesystem.pm
+++ b/Bugzilla/Install/Filesystem.pm
@@ -139,6 +139,7 @@ sub FILESYSTEM {
'docs/*/README.docs' => { perms => $owner_readable },
"$datadir/bugzilla-update.xml" => { perms => $ws_writeable },
"$datadir/params" => { perms => $ws_writeable },
+ "$datadir/old-params.txt" => { perms => $owner_readable },
"$extensionsdir/create.pl" => { perms => $owner_executable },
);
@@ -369,6 +370,12 @@ sub update_filesystem {
_rename_file($testfile, "$testfile.old");
}
+ # If old-params.txt exists in the root directory, move it to datadir.
+ my $oldparamsfile = "old_params.txt";
+ if (-e $oldparamsfile) {
+ _rename_file($oldparamsfile, "$datadir/$oldparamsfile");
+ }
+
_create_files(%files);
if ($params->{index_html}) {
_create_files(%{$fs->{index_html}});