diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2011-08-04 22:53:52 +0200 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2011-08-04 22:53:52 +0200 |
| commit | af8e935a3e793538b21e5a952e0963e7b9af044e (patch) | |
| tree | ca045bd14600a1f4a07fb3a7f53481e4593369c8 /Bugzilla | |
| parent | 75b2accb3ad0c02aff7d1c5925456040abb130a8 (diff) | |
| download | bugzilla-af8e935a3e793538b21e5a952e0963e7b9af044e.tar.gz bugzilla-af8e935a3e793538b21e5a952e0963e7b9af044e.tar.xz | |
Bug 674497: (CVE-2011-2979) [SECURITY] Custom searches let you determine if a group exists or not
r=glob a=LpSolit
Diffstat (limited to 'Bugzilla')
| -rw-r--r-- | Bugzilla/Search.pm | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Bugzilla/Search.pm b/Bugzilla/Search.pm index 16e72b296..a5c3e032d 100644 --- a/Bugzilla/Search.pm +++ b/Bugzilla/Search.pm @@ -2007,7 +2007,7 @@ sub _contact_exact_group { my $user = $self->_user; $value =~ /\%group\.([^%]+)%/; - my $group = Bugzilla::Group->check($1); + my $group = Bugzilla::Group->check({ name => $1, _error => 'invalid_group_name' }); $group->check_members_are_visible(); $user->in_group($group) || ThrowUserError('invalid_group_name', {name => $group->name}); @@ -2054,7 +2054,7 @@ sub _cc_exact_group { my $dbh = Bugzilla->dbh; $value =~ m/%group\.([^%]+)%/; - my $group = Bugzilla::Group->check($1); + my $group = Bugzilla::Group->check({ name => $1, _error => 'invalid_group_name' }); $group->check_members_are_visible(); $user->in_group($group) || ThrowUserError('invalid_group_name', {name => $group->name}); |