diff options
author | Frédéric Buclin <LpSolit@gmail.com> | 2010-08-05 00:10:22 +0200 |
---|---|---|
committer | Frédéric Buclin <LpSolit@gmail.com> | 2010-08-05 00:10:22 +0200 |
commit | 861fef876f3cb8a50437ee41b6ba4c8d0cb1e239 (patch) | |
tree | b76de5a3b2541e76ee018f6a7e8afd33ecf8f979 /Bugzilla/Template.pm | |
parent | 2ea4b3d38e8a012f61d20e6831daaf06493c3d95 (diff) | |
download | bugzilla-861fef876f3cb8a50437ee41b6ba4c8d0cb1e239.tar.gz bugzilla-861fef876f3cb8a50437ee41b6ba4c8d0cb1e239.tar.xz |
Bug 583690: (CVE-2010-2759) [SECURITY][PostgreSQL] Bugzilla crashes when viewing a bug if a comment contains 'bug <num>' or 'attachment <num>' where <num> is greater than the max allowed integer
r=mkanat a=LpSolit
Diffstat (limited to 'Bugzilla/Template.pm')
-rw-r--r-- | Bugzilla/Template.pm | 18 |
1 files changed, 6 insertions, 12 deletions
diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm index 4abc8a6ee..923336d45 100644 --- a/Bugzilla/Template.pm +++ b/Bugzilla/Template.pm @@ -268,21 +268,15 @@ sub get_attachment_link { my ($attachid, $link_text) = @_; my $dbh = Bugzilla->dbh; - detaint_natural($attachid) - || die "get_attachment_link() called with non-integer attachment number"; + my $attachment = new Bugzilla::Attachment($attachid); - my ($bugid, $isobsolete, $desc, $is_patch) = - $dbh->selectrow_array('SELECT bug_id, isobsolete, description, ispatch - FROM attachments WHERE attach_id = ?', - undef, $attachid); - - if ($bugid) { + if ($attachment) { my $title = ""; my $className = ""; - if (Bugzilla->user->can_see_bug($bugid)) { - $title = $desc; + if (Bugzilla->user->can_see_bug($attachment->bug_id)) { + $title = $attachment->description; } - if ($isobsolete) { + if ($attachment->isobsolete) { $className = "bz_obsolete"; } # Prevent code injection in the title. @@ -294,7 +288,7 @@ sub get_attachment_link { # If the attachment is a patch, try to link to the diff rather # than the text, by default. my $patchlink = ""; - if ($is_patch and Bugzilla->feature('patch_viewer')) { + if ($attachment->ispatch and Bugzilla->feature('patch_viewer')) { $patchlink = '&action=diff'; } |