diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2012-04-18 18:47:02 +0200 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2012-04-18 18:47:02 +0200 |
| commit | 935031c50d693cb8d8a1c4c8e1567df6310766da (patch) | |
| tree | 10f5e280d667eef8f762930fa9c0c95a2a634e85 /Bugzilla/Config | |
| parent | 280f6a0f92b153f647ab15647017d2e9e90301d2 (diff) | |
| download | bugzilla-935031c50d693cb8d8a1c4c8e1567df6310766da.tar.gz bugzilla-935031c50d693cb8d8a1c4c8e1567df6310766da.tar.xz | |
Bug 728639: (CVE-2012-0465) [SECURITY] User lockout policy can be bypassed by altering the X-FORWARDED-FOR header
r=glob a=LpSolit
Diffstat (limited to 'Bugzilla/Config')
| -rw-r--r-- | Bugzilla/Config/Advanced.pm | 3 | ||||
| -rw-r--r-- | Bugzilla/Config/Common.pm | 11 |
2 files changed, 12 insertions, 2 deletions
diff --git a/Bugzilla/Config/Advanced.pm b/Bugzilla/Config/Advanced.pm index faab6bbbd..941cefc4f 100644 --- a/Bugzilla/Config/Advanced.pm +++ b/Bugzilla/Config/Advanced.pm @@ -46,7 +46,8 @@ use constant get_param_list => ( { name => 'inbound_proxies', type => 't', - default => '' + default => '', + checker => \&check_ip }, { diff --git a/Bugzilla/Config/Common.pm b/Bugzilla/Config/Common.pm index 9fffe02ee..00c699217 100644 --- a/Bugzilla/Config/Common.pm +++ b/Bugzilla/Config/Common.pm @@ -48,7 +48,7 @@ use base qw(Exporter); qw(check_multi check_numeric check_regexp check_url check_group check_sslbase check_priority check_severity check_platform check_opsys check_shadowdb check_urlbase check_webdotbase - check_user_verify_class + check_user_verify_class check_ip check_mail_delivery_method check_notification check_utf8 check_bug_status check_smtp_auth check_theschwartz_available check_maxattachmentsize check_email @@ -129,6 +129,15 @@ sub check_sslbase { return ""; } +sub check_ip { + my $inbound_proxies = shift; + my @proxies = split(/[\s,]+/, $inbound_proxies); + foreach my $proxy (@proxies) { + validate_ip($proxy) || return "$proxy is not a valid IPv4 or IPv6 address"; + } + return ""; +} + sub check_utf8 { my $utf8 = shift; # You cannot turn off the UTF-8 parameter if you've already converted |