diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2012-11-13 18:19:46 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2012-11-13 18:19:46 +0100 |
| commit | a9aa10209a82ee3fafc765fa3764b6784ef7ff28 (patch) | |
| tree | 919f03090d9e08792ac4c41f8b560b969755bb3d /Bugzilla | |
| parent | 1b925f4bdf4fef4b0f6a115223d6d1bb68ece52f (diff) | |
| download | bugzilla-a9aa10209a82ee3fafc765fa3764b6784ef7ff28.tar.gz bugzilla-a9aa10209a82ee3fafc765fa3764b6784ef7ff28.tar.xz | |
Bug 802204 (CVE-2012-4197): [SECURITY] Marking an attachment you cannot see as obsolete can disclose its description
r=gerv a=LpSolit
Diffstat (limited to 'Bugzilla')
| -rw-r--r-- | Bugzilla/Attachment.pm | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/Bugzilla/Attachment.pm b/Bugzilla/Attachment.pm index 982435a3a..ba6c25736 100644 --- a/Bugzilla/Attachment.pm +++ b/Bugzilla/Attachment.pm @@ -766,11 +766,8 @@ sub validate_obsolete { $attachment->validate_can_edit($bug->product_id) || ThrowUserError('illegal_attachment_edit', { attach_id => $attachment->id }); - $vars->{'description'} = $attachment->description; - if ($attachment->bug_id != $bug->bug_id) { $vars->{'my_bug_id'} = $bug->bug_id; - $vars->{'attach_bug_id'} = $attachment->bug_id; ThrowUserError('mismatched_bug_ids_on_obsolete', $vars); } |