Bug 1230932 - Providing a condition as an ID to the webservice results in a taint error

r=dkl,a=dkl

2 files changed, 3 insertions, 22 deletions

diff --git a/Bugzilla/API/1_0/Constants.pm b/Bugzilla/API/1_0/Constants.pm
index 44e20124a..f90b31177 100644
--- a/Bugzilla/API/1_0/Constants.pm
+++ b/Bugzilla/API/1_0/Constants.pm
@@ -68,6 +68,8 @@ use constant WS_ERROR_CODE => {
     number_too_large            => 54,
     number_too_small            => 55,
     illegal_date                => 56,
+    param_integer_required      => 57, 
+    param_integer_array_required => 58,
     # Bug errors usually occupy the 100-200 range.
     improper_bug_id_field_value => 100,
     bug_id_does_not_exist       => 101,
diff --git a/Bugzilla/API/1_0/Util.pm b/Bugzilla/API/1_0/Util.pm
index d22935f6e..3fcf28cdf 100644
--- a/Bugzilla/API/1_0/Util.pm
+++ b/Bugzilla/API/1_0/Util.pm
@@ -22,6 +22,7 @@ use MIME::Base64 qw(decode_base64 encode_base64);
 use Storable qw(dclone);
 use Test::Taint ();
 use URI::Escape qw(uri_unescape);
+use Bugzilla::WebService::Util qw(validate);
 
 use parent qw(Exporter);
 
@@ -241,28 +242,6 @@ sub api_include_exclude {
     return $params;
 }
 
-sub validate  {
-    my ($self, $params, @keys) = @_;
-
-    # If $params is defined but not a reference, then we weren't
-    # sent any parameters at all, and we're getting @keys where
-    # $params should be.
-    return ($self, undef) if (defined $params and !ref $params);
-
-    # If @keys is not empty then we convert any named
-    # parameters that have scalar values to arrayrefs
-    # that match.
-    foreach my $key (@keys) {
-        if (exists $params->{$key}) {
-            $params->{$key} = ref $params->{$key}
-                              ? $params->{$key}
-                              : [ $params->{$key} ];
-        }
-    }
-
-    return ($self, $params);
-}
-
 sub translate {
     my ($params, $mapped) = @_;
     my %changes;