Bug 434801: [SECURITY] .htaccess doesn't prevent reading old-params.txt from the web

Patch by Reed Loden <reed@reedloden.com> r=mkanat a=LpSolit

2 files changed, 14 insertions, 4 deletions

diff --git a/Bugzilla/Config.pm b/Bugzilla/Config.pm
index 0361592bf..a7184866f 100644
--- a/Bugzilla/Config.pm
+++ b/Bugzilla/Config.pm
@@ -221,7 +221,7 @@ sub update_params {
     # --- REMOVE OLD PARAMS ---
 
     my %oldparams;
-    # Remove any old params, put them in old-params.txt
+    # Remove any old params
     foreach my $item (keys %$param) {
         if (!grep($_ eq $item, map ($_->{'name'}, @param_list))) {
             $oldparams{$item} = $param->{$item};
@@ -229,13 +229,16 @@ sub update_params {
         }
     }
 
+    # Write any old parameters to old-params.txt
+    my $datadir = bz_locations()->{'datadir'};
+    my $old_param_file = "$datadir/old-params.txt";
     if (scalar(keys %oldparams)) {
-        my $op_file = new IO::File('old-params.txt', '>>', 0600)
-          || die "old-params.txt: $!";
+        my $op_file = new IO::File($old_param_file, '>>', 0600)
+          || die "Couldn't create $old_param_file: $!";
 
         print "The following parameters are no longer used in Bugzilla,",
               " and so have been\nmoved from your parameters file into",
-              " old-params.txt:\n";
+              " $old_param_file:\n";
 
         local $Data::Dumper::Terse  = 1;
         local $Data::Dumper::Indent = 0;
diff --git a/Bugzilla/Install/Filesystem.pm b/Bugzilla/Install/Filesystem.pm
index 99f71d989..44c34718e 100644
--- a/Bugzilla/Install/Filesystem.pm
+++ b/Bugzilla/Install/Filesystem.pm
@@ -139,6 +139,7 @@ sub FILESYSTEM {
         'docs/*/README.docs'   => { perms => $owner_readable },
         "$datadir/bugzilla-update.xml" => { perms => $ws_writeable },
         "$datadir/params" => { perms => $ws_writeable },
+        "$datadir/old-params.txt" => { perms => $owner_readable },
         "$extensionsdir/create.pl" => { perms => $owner_executable },
     );
 
@@ -369,6 +370,12 @@ sub update_filesystem {
         _rename_file($testfile, "$testfile.old");
     }
 
+    # If old-params.txt exists in the root directory, move it to datadir.
+    my $oldparamsfile = "old_params.txt";
+    if (-e $oldparamsfile) {
+        _rename_file($oldparamsfile, "$datadir/$oldparamsfile");
+    }
+
     _create_files(%files);
     if ($params->{index_html}) {
         _create_files(%{$fs->{index_html}});